The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

An alternative method for verifying a traversal flaw with write access is

to try to write a new file within the web root of the web server and then

attempt to retrieve this with a browser. However, this method may not

work if you do not know the location of the web root directory or the

user context in which the file access occurs does not have permission to

write there.

Figure 10-1:  A successful path traversal attack

N OT E

Virtually all file systems tolerate redundant traversal sequences which

appear to try and step up above the root of the file system. Hence, it is usually

advisable to submit a large number of traversal sequences when probing for a

338

Chapter 10 

■

Exploiting Path Traversal

70779c10.qxd:WileyRed  9/16/07  4:25 PM  Page 338

---

flaw, as in the examples given here. It is possible that the starting directory to