Introduction to path traversal attack

Editor's Notes

• #3 Directory Traversal attacks is an HTTP exploit or vulnerability which allows attackers or hackers to access restricted directories (most hackers are interested in root directory access) and execute commands outside of the web server’s root directory. The goal of this attack is to access sensitive files placed on a web server by stepping inside the root directory using the dot dot slash technique. By exploiting a directory traversal vulnerability, an attacker can access files in directories other than the root directory. This can be harmful, since access to restricted files containing passwords or other private information may compromise the web server. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. Path Traversals are made possible when access to web content is not properly controlled and the web server is compromised. This is basically an HTTP exploit that gives malicious attackers unauthorized access to restricted directories. They are eventually able to manipulate the web server and execute malicious commands outside its root directory/folder. Most web applications serve static resources like images and CSS files. Frequently, applications simply serve all the files in a folder. If the application isn't careful, the user can use a path traversal attack to read files from other folders that they shouldn't have access to. For example, in both Windows and Linux, .. represents the parent directory, so if you can inject ../ in a path you can "escape" to the parent directory. These attacks are usually executed with the help of injections such as Resource Injections, typically executed with the help of crawlers. The attack usually involves the following steps: 1. The user/victim enters input into the application 2. The user input is used to access a specific file (to read, write or send it) 3. The attacker uses resource identifiers to manipulate the vulnerable application 4. Parameters such as file names and port numbers are altered to initiate the attack 5. The vulnerable application is basically tricked into granting access to the sensitive file/s even when the attacker doesn’t have the required permissions 6. The attacker can then overwrite/modify files and even send them to third-party servers
• #4 There are two primary security mechanisms available today in web servers: Access Control Lists (ACLs) – These are basically whitelists that the web server’s administrator uses to monitor access permissions. These lists are used in the authorization process. Only users with permissions can access, modify or share sensitive files and information. Root Directory – This directory is located in the server file system and users simply can’t access sensitive files above this root. One such example is the sensitive cmd.exe file on Windows platforms, which rests in the root directory that not everyone can access. A directory is basically a folder where web designer’s store their website files (with respect to server). By “directory traversal attack,” I simply mean that the hacker is able to navigate between the directories and the files stored in those directories – like the root, which contains all confi files, htaccess files, ini files, and xquery files. These files are sensible for any website, if their security is not handled properly then a hacker will easily dominate the site. In short, by using a directory traversal attack, a hacker’s main goal is to get access to any of the sensible files mentioned above.Attackers can also use directory traversal attacks to view arbitrary files on web servers like SSL private keys and password files.Directory traversal is also known as the ../ (dot dot slash) attack, directory climbing, and backtracking.
• #9 There’s a serious security vulnerability in the Belkin N150 wireless router that can enable a remote, unauthenticated attacker to read any system file on a vulnerable router. The bug is a directory traversal vulnerability and the CERT/CC advisory says that all versions of the router that are running firmware up to and including firmware version 1.00.07 are vulnerable. The N150 is a low-end wireless home router, and the company has produced a new version of the firmware to correct the vulnerability. “Belkin N150 wireless router firmware versions 1.00.07 and earlier contain a path traversal vulnerability through the built-in web interface. The webproc cgi module accepts a getpage parameter which takes an unrestricted file path as input. The web server runs with root privileges by default, allowing a malicious attacker to read any file on the system,”