‫Pat traversal.
‫Web applications sometimes require reading from or writing to a file system.
‫So by crafting parameters that reference files on the system, yeah, it's possible to access other
‫files that are stored on the server.
‫So a path traversal attack may enable us to read sensitive data, including passwords, application
‫logs and oh so much more.
‫And we can view security critical items such as configuration files and software binaries as well.
‫Now, if we're really good, we're able to navigate out of the Webroot folder and then we can perform
‫paff traversal attacks.
‫So users should only be restricted to the Web directory.
‫OK, and they should not be able to access anything above the webroot.
‫Now, the most basic path to virtual attack is using the dot, dot, slash to move up one directory.
‫And most Web servers have been locked down to prevent this attack, but you never know, some will still
‫accept it.
‫OK, then, so let's go to Calli, log in to be Web.
‫Use the drop down menu and open directory traversal directory.
‫Now, there's nothing strange on the first page at first look.
‫But look at this.
‫When you start to pay attention to the Eurail, the directory parameter in the early can reveal something.
‫So let's delete this value.
‫So the warning this directory doesn't exist appears.
‫OK.
‫This means that parameter takes the name of the folder on the file system and prints the content of
‫that folder.
‫So now we can guess folder's generally residing in applications such as JavaScript.
‫Images.
‫Stylesheets.
‫And, of course, admen.
‫Oh, it works perfectly.
‫OK, so then we can try to traverse in the directories now.
‫So for this, we need to climb up in between folder's.
‫Now, I know that the back end is Lennix, and so that means I'm going to use Linux filesystems placeholders
‫to traverse between folders.
‫So first thing to do is print what's inside the current folder.
‫And the application executes the placeholder for the current directory.
‫And look at the documents and folders under the current directory.
‫Right, so we are still in the current directory now, climb up one level using this placeholder.
‫And it works climb up one more level again and climb up one more again.
‫I think we should be in the root directory now.
‫But we can try to climb up one more again.
‫All right, so climbing up is done, so now it's time to traverse.
‫Via the home directory.
‫And these are the user's home directories.
‫So we'll go to B's folder.
‫OK, so go to document.
‫And view the scripts folder.
‫And here are some scripts that run over the system.
‫So in a situation like this, you can view many important files and configurations, right?
‫In past traversal, I generally go to the ETEK directory and show password file.
‫But this vulnerability these days works really only to view the content of the folders and not the files
‫themselves.
‫OK, so anyway, let's change the level now to medium.
‫OK, and put the current folder placeholder to check traversing and of course, we get a warning.
‫We are detected.
‫So let's see if that means that we also cannot climb.
‫OK, so sadly, that's true.
‫Climbing is fun, but what happens if you just drive forward slash?
‫Oh, that works.
‫OK, so it prints the content of the root directory.
‫I think the developer is escaping the dot.
‫So we can check the code later.
‫Right now, let's go to B's folder.
‫And that's nice this way we can traverse between folder's and unless you change the level of high,
‫so delete the current value.
‫An error message appears and hasn't stopped us before, so let's try to climb.
‫And traverse.
‫OK, so that's not working.
‫So now let's go and view the code.
‫So if you directory traversal to page and scroll down to code.
‫So here's a function called Show Directory.
‫And it has a directory parameter.
‫Check and see if the directory exists.
‫The content of that directory.
‫Scroll down a little bit more.
‫And the directory parameter and you are l passes to the show directory function.
‫So the security level's low, show directory function just executes if the level is medium, the parameter
‫we provide from the URL is checked with directory traversal check to function.
‫And for the high level directory traversal, check three is used.
‫All right, so now let's have a look at these two functions that scroll down to the functions that were
‫searching.
‫All right, so here's the last one.
‫That's why we are restricted to Webroot directory only.
‫All right, so now let's go to the other function, and it checks for placeholders that we use to climb
‫and traverse.
‫All right, so you get the idea, you can always analyze a code more line by line by yourself.