PortSwigger Lab Write-up: Path Traversal or Directory Traversal Vulnerability.
I’m Subhadip Sardar, a cybersecurity enthusiast with a strong foundation in IT and cybersecurity. I’m passionate about sharing knowledge and empowering the community to build safer digital environments. Currently, I’m creating an in-depth guide to the Directory Traversal vulnerability and solving practical labs from PortSwigger, designed to help others understand and defend against common web security threats. Join me as we explore the world of cybersecurity.
What is Path Traversal vulnerability?
Path traversal vulnerability, also known as directory traversal, is a security flaw that allows an attacker to access directories and files that are stored outside the web root folder. By exploiting this vulnerability, an attacker can manipulate input parameters to navigate through the directory structure on the server, potentially gaining access to sensitive information such as configuration files, password files, and other critical data.
How Path Traversal Works
- User Input: A web application takes input from the user, such as a file name or a path.
- Manipulation: The attacker manipulates this input to include special characters that change the directory path, such as ‘../’ (which means “up one directory”).
- Unsensitized Input: If the application does not properly sanitize or validate this input, it may concatenate this manipulated input to the base directory path.
- Access: The application then attempts to access the file or directory specified by this manipulated path, potentially leading to unauthorized access to sensitive files.
Example Scenario
Suppose a web application allows users to view files stored on the server by specifying a filename in the URL:
https://example.com/view?file=report.txtIf the application concatenates this input to a base directory path without proper sanitation, an attacker can manipulate the input as follows:
https://example.com/view?file=../../etc/passwdIn this example, ‘../../’ moves up two directories, potentially allowing the attacker to access the system’s password file (/etc/passwd), which should be restricted.
Practical: File path traversal, simple case
- Go to Lab home page. Intercept the request with burp Suite and check the request parameter. Here, we see the parameter is ‘/image?filename=19.jpg’. It means the ‘19.jpg’ file will be stored inside the /image directory and the full path is ‘/var/www/image/19.jpg’.
2. Then the captured request parameter sends to the Repeater. Then modify the GET parameter ‘/image?filename=19.jpg’ to ‘/image?filename=../../../etc/passwd’ for read the ‘/etc/passwd’ file which content the user information.
Then click on Send. Then we can see the information of the /etc/passwd file will be shown inside the response section.
Common obstacles to exploiting path traversal vulnerability
- If an application strips or blocks directory traversal sequences from the user-supplied filename, it might be possible to bypass the defence by directly using ‘filename=/etc/passwd’.
Practical: File path traversal, traversal sequences blocked with absolute path bypass
Go to Lab home page and Use Burp Suite to intercept a request that fetches a product image.
Next, go to Burp Suite and Send the intercepted request to Burp Repeater.
Modify the filename parameter, giving it the value /etc/passwd and send the request and observe that the response contains the contents of the /etc/passwd file.
2. You might be able to use nested traversal sequences, such as ‘filename=….//etc/passwd’ or ‘filename=….\/etc/passwd’. These revert to simple traversal sequences when the inner sequence is stripped.
Practical: File path traversal, traversal sequences stripped non-recursively
Go to Lab home page and Use Burp Suite to intercept a request that fetches a product image.
Next, go to Burp Suite and Send the intercepted request to Burp Repeater.
Modify the filename parameter, giving it the value:
....//....//....//etc/passwdSend the request and observe that the response contains the contents of the /etc/passwd file.
3. Use URL encoding or even double URL encoding the ‘../’ characters. This results in ‘filename=%2e%2e%2fetc/passwd’ or ‘filename=%252e%252e%252fetc/passwd’ and also use various non-standard encodings, such as ‘..%c0%af’ or ‘..cf%bc%8f’ and also use ‘..%252F..%252Fetc/passwd’ etc.
Practical: File path traversal, traversal sequences stripped with superfluous URL-decode
Go to Lab home page and Use Burp Suite to intercept a request that fetches a product image.
Next, go to Burp Suite and Send the intercepted request to Burp Repeater.
Modify the filename parameter, giving it the value:
..%252f..%252f..%252fetc/passwdSend the request and observe that the response contains the contents of the /etc/passwd file.
4. When an application may require the user-supplied filename to start with the expected base folder, such as ‘/var/www/images’. In this case, it might be possible to include the required base folder followed by suitable traversal sequences. For example: filename=/var/www/images/../../../etc/passwd.
Practical: File path traversal, validation of start of path
Go to Lab home page and Use Burp Suite to intercept a request that fetches a product image.
Next, go to Burp Suite and Send the intercepted request to Burp Repeater.
Modify the filename parameter, giving it the value:
/var/www/images/../../../etc/passwdSend the request and observe that the response contains the contents of the /etc/passwd file.
5. An application may require the user-supplied filename to end with an expected file extension, such as ‘.png’. In this case, it might be possible to use a null byte to effectively terminate the file path before the required extension. For example: filename=../../../etc/passwd%00.png.
Practical: File path traversal, validation of file extension with null byte bypass
Go to Lab home page and Use Burp Suite to intercept a request that fetches a product image.
Next, go to Burp Suite and Send the intercepted request to Burp Repeater.
Modify the filename parameter, giving it the value:
../../../etc/passwd%00.pngSend the request and observe that the response contains the contents of the /etc/passwd file.
Prevent Path Traversal Vulnerability
Here are some best practices to prevent path traversal attacks:
- Input Validation and Sanitization:
- Whitelist Approach: Only allow specific, known-good inputs. Reject any inputs that don’t match the allowed patterns.
- Blacklist Approach: Block known bad characters and patterns like .., /, and \.
- Normalization: Normalize file paths to remove any potential traversal sequences. For example, convert relative paths to absolute paths.
2. Use Built-in Functions
Get SubhaDip’s stories in your inbox
Join Medium for free to get updates from this writer.
Use language-specific functions that handle file paths securely:
- In Python, use os.path.abspath() and os.path.normpath() to get absolute and normalized paths.
- In Java, use java.nio.file.Paths and java.nio.file.Path.
3. Limit User Input to Specific Directories: Restrict user input to specific directories. For example, use a root directory and ensure all file operations are confined within this directory.
4. Avoid Using User Input Directly in File Operations: Construct file paths carefully and avoid directly appending user inputs to file paths.
5. Use Secure Functions for File Access:
Prefer functions that enforce security checks:
- In Python, use os.path.join() to construct file paths safely.
- In Java, use File.getCanonicalPath() to validate file paths.
6. Web Server Configuration: Configure your web server to deny access to sensitive directories and files. Use .htaccess in Apache or appropriate configurations in Nginx to restrict access.
7. Use Security Libraries: Leverage existing security libraries and frameworks that provide built-in protection against path traversal.
8. Logging and Monitoring: Implement logging and monitoring to detect any suspicious activities related to file access.
I hope you enjoyed this write-up! Thank You! Happy Hacking :)
Follow to me on Medium and be sure to turn on email notifications so you never miss out on my latest informative posts.
Follow me on below Social Media:
- LinkedIn: Subhadip Sardar
- Twitter | X : @Mr_SubhaDip03
- GitHub : SubhaDip003
- Check My TryHackMe Profile : TryHackMe | SubhaDip
