The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 10 

■

Exploiting Path Traversal

345

70779c10.qxd:WileyRed  9/14/07  3:14 PM  Page 345

---

directory is treated as if it is the file system root, and any redundant tra-

versal sequences that attempt to step up above it are ignored.

Chrooted

file systems are supported natively on most Unix-based plat-

forms. A similar effect can be achieved on Windows platforms (in rela-

tion to traversal vulnerabilities, at least) by mounting the relevant start

directory as a new logical drive and using the associated drive letter to

access its contents.

■■

The application should integrate its defenses against path traversal

attacks with its logging and alerting mechanisms. Whenever a request

is received that contains path traversal sequences, this indicates likely

malicious intent on the part of the user, and the application should log

the request as an attempted security breach, terminate the user’s ses-

sion, and if applicable, suspend the user’s account and generate an alert

to an administrator.

Chapter Summary

Path traversal can often be a devastating vulnerability, enabling you to break

through many layers of security controls to gain direct access to sensitive data,

including passwords, configuration files, application logs, and source code. If

the vulnerability grants write access, it can quickly lead to a complete com-

promise of the application and underlying server. 

Path traversal bugs are surprisingly common; however, they are often sub-

tle to detect and may be protected by various kinds of input validation which

deflect the most obvious attacks but can nevertheless be bypassed with skill

and determination. The most important lesson when probing for path traver-

sal flaws is to be patient and work systematically to try to understand pre-

cisely how your input is being handled, and how the server’s processing can

be manipulated to achieve success.

Questions

Answers can be found at 

www.wiley.com/go/webhacker

.

1. You insert a standard path traversal detection string into the 

following URL:

https://wahh-app.com/logrotate.pl?file=../../../../../etc/passwd