Saltar al contenido principal
CargarIdioma (ES)Atención al cliente
EmpresarialesMóvilRedes socialesMarketingTecnologíaArte y fotografíaEmpleoDiseñoEducaciónPresentaciones y charlas públicasGobierno y org. sin ánimo de lucroAtención sanitariaInternetDerechoLiderazgo y gestiónMotorIngenieríaSoftwareReclutamiento y RR. HH.Venta al por menorVentasServiciosCienciasPYMES y liderazgoAlimentaciónMedio ambienteEconomía y finanzasDatos y análisisRelaciones con inversoresDeportesMeditaciónNoticias y políticaViajesDesarrollo personalSector inmobiliarioEntretenimiento y humorSalud y medicinaDispositivos y hardwareEstilo de vida
Prashant Hegde, profile picture
Subido porPrashant Hegde
PPTX, PDF1,772 vistas

Introduction to path traversal attack

Path traversal attacks aim to access files outside a webroot folder by exploiting how web servers handle special directory traversal characters like "..". An attacker can use these characters in a request to climb the directory structure and potentially read sensitive files. They may also try encoding the special characters to bypass security filters. To prevent this, servers should carefully filter user input, ensure only authorized directories are accessible, and keep sensitive files outside public folders.

Tecnología◦
Temas relacionados:
Software Testing Insights• Security Testing•
Descargado 58 veces
freegoogleslidestemplates.com Path Traversal Prashant.Hegde Amith.Gugihal Akshay.Tadapatri An Introduction DOT-DOT-SLASH DIRECTORY TRAVERSAL DIRECTORY CLIMBINGBACKTRACKING
● A path traversal attack aims to access files and directories that are stored outside the webroot folder. It should be noted that access to files is limited by system operational access control (such as in the case of locked or in-use files on the Microsoft Windows operating system). ● To access files or execute commands anywhere on the file-system, Path traversal attacks utilize the ability of special characters sequences. WHAT IS PATH TRAVERSAL ATTACK?
WHAT IS A DIRECTORY? ● In computing, a directory is a file system cataloging structure which contains references to other computer files, and possibly other directories. ● The top-most directory in such a filesystem, which does not have a parent of its own, is called the root directory. ● Root Directory – This directory is located in the server file system and users simply can’t access sensitive files above this root. One such example is the sensitive cmd.exe file on Windows platforms, which rests in the root directory that not everyone can access.
ROOT DIRECTORY sdgfgdffffffffffffff
● The “..” instructs the system to go one directory (or folder) up. For example : we are at this location C:/Apps/Games Now on typing “../”, we would reach C:/Apps To access files or execute commands anywhere on the File-system, Path Traversal attacks will utilize the ability of special-characters sequences. What does ../ or .. (dot dot slash) mean?
Encoding and double encoding ● Most web servers prevent ‘../’ technique from escaping the web document root, alternate encodings of the "../" sequence may help bypass the security filters ● These method variations include valid and invalid Unicode-encoding ("..%u2216" or "..%c0%af") of the forward slash character, backslash characters ("..") on Windows-based servers, URL encoded characters "%2e%2e%2f"), and double URL encoding ("..%255c") of the backslash character ● This attack technique consists of encoding user request parameters twice in hexadecimal format in order to bypass security controls or cause unexpected behavior from the application. It's possible because the web server accepts and processes client requests in many encoded forms.
%2e%2e%2f ../ %2e%2e/ ../ ..%2f ../ %2e%2e%5c .. %2e%2e .. ..%5c .. %252e%252e%255c .. ..%255c .. Encoding and double encoding %2e = . %2f = / %5c = %252e= . %255c =
● There was a serious security vulnerability in the Belkin N150 wireless router that can enable a remote, unauthenticated attacker to read any system File on a vulnerable router. ● Belkin N150 wireless router firmware versions 1.00.07 and earlier contain a path traversal vulnerability through the built-in web interface. The webproc cgi module accepts a getpage parameter which takes an unrestricted file path as input. The web server runs with root privileges by default, allowing a malicious attacker to read any file on the system
TIME FOR DEMONSTRATION
https://google-gruyere.appspot.com/start CHALLENGE 1 1. NAVIGATE TO 2. Find a way to read a File from a running Gruyere server using path traversal. HINT: it’s a Secret File
https://google-gruyere.appspot.com/start CHALLENGE 2 1. NAVIGATE TO 2.Find a way to replace secret.txt on a running Gruyere server. HINT: You need to create a new user WITH DOTS
How to prevent Path Traversal attacks?
● Don’t store old, sensitive, or otherwise nonpublic files on your web server. The only files that should be in your /htdocs or DocumentRoot folder are those that are needed for the site to function properly. ● The latest versions of the web servers have good directory security by default so, if possible, make sure you’re running the latest versions. ● Effectively Filter any user input. Ideally remove everything but the known good data and filter meta characters from the user input. This will ensure that attackers cannot use commands that leave the root directory or violate other access privileges. ● Remove “..” and “../” from any input that’s used in a file context. ● Ensure that your web server is properly configured to allow public access to only those directories that are needed for the site to function.
Thank YouFor Your Attention