‫OK, so another type of directory traversal allows us to read the content of any file.
‫So are these such bugs we need to climb and traverse between folders again.
‫So we'll go to county and log in to be Web.
‫Open directory traversal file from the menu above.
‫And here's a sample page.
‫As you can see, there's nothing with the page itself.
‫So this means that you've got to pay attention.
‫To the you are l just like the previous lessem.
‫Now, it's easy to guess that this time the application displays the content of the file passes page
‫parameter, right.
‫And call the magic file slash ATC slash password.
‫And here's the content of the file, see how perfect this is.
‫So now we can try to climb to reach that same file.
‫Climb up one more level.
‫Now, then climb up more again, no, and climb up one more level.
‫Oh, there it is.
‫So over this kind of traversal attack, we can use it to end called dot, dot, own.
‫Now, it's very easy to use, but first we do need to capture the request.
‫So enable Foxe proxy.
‫Then open berp in interception mode.
‫I'm just going to rearrange the screens for a little bit of you.
‫OK, so now refresh the page.
‫And here is a request in berp.
‫So now I'm going to change here to the string traversal.
‫And copy this request to a file.
‫And let's call it DTT and save.
‫OK, good.
‫So now go to your terminal, simply type dot, dot, PWI in and we'll look at the options.
‫And the options are very clear, so let's run, dot, dot, own against BEA Web.
‫Type dot dot P.W. N. m payload.
‫So the mm parameter is used, you specify the module.
‫Now, because we're going to use the berp output, we should choose this module.
‫And then H for the name of the host.
‫And P for the burbs output file.
‫Oh, Eunuch's, you can use this parameter if you know the target operating system, it's not necessarily
‫necessary and f etsi password, so it is you can look for a specific file on the target file system.
‫Told you earlier I like the password.
‫The three to specify the depth of the payload.
‫And X 80, and that specifies a port No.
‫So finally be to quit after the first vulnerability's found.
‫OK, so now we can hit enter.
‫Oh, dear.
‫Something went wrong.
‫Let me just have a look quickly.
‫And OK, yeah, so I forgot to add a parameter, the parameter K, so add K root.
‫To make the tool understand if it is able to read the final content or not.
‫OK, then go.
‫And it discovered the traversal.
‫And as you can see, it detects the same way we do three consecutive climbs.
‫Now I'm going to exclude the parameter B.
‫So this time it's going to discover as many payloads as it can.
‫All right, so it finds three different versions of payload.
‫OK, so then go to the Web browser again.
‫Disable Foxe proxy.
‫And now change it to a medium level.
‫So I'm going to add the path that we used before.
‫OK, so it doesn't work.
‫OK, so I can delete the first two placeholders.
‫And it works pretty well, huh?
‫And for the last level.
‫I will add the same payload.
‫And it doesn't work.
‫OK, so to be honest, I was waiting for this result.
‫I'm not surprised.
‫But I want to set it up on purpose, obviously, but I want to show you another trick to use here.
‫The final protocols.
‫So type file Colin Haggar, slash etsi slash password, and there you have it.
‫OK, so I want to show you the vulnerable code as well, but it really isn't actually very different
‫than the first one, so I'm going to leave it for you to look at.
‫All right.
‫Good job.