The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

commands. 

N OT E

If you have local access to the application (either in a white-box testing

exercise or because you have compromised the server’s operating system),

identifying targets for path traversal testing is usually straightforward, because

you can monitor all file system interaction performed by the application.

70779c10.qxd:WileyRed  9/14/07  3:13 PM  Page 335

---

HACK STEPS

If you have local access to the web application:

■

Use a suitable tool to monitor all file system activity on the server. For

example, the FileMon tool from SysInternals can be used on the Win-

dows platform, the 

ltrace

/

strace

tools can be used on Linux, and the

truss