Add directory traversal (dot-dot-slash) solution

1 files changed, 8 insertions, 0 deletions

diff --git a/Directory traversal/Resources/notes.md b/Directory traversal/Resources/notes.md
new file mode 100644
index 0000000..d4068b8
--- /dev/null
+++ b/Directory traversal/Resources/notes.md
@@ -0,0 +1,8 @@
+## Exploit
+
+1. Pages being fetched with a query parameter `page` (`http://10.0.2.15/?page=somePage`) expose the server to dot-dot-slash attack.
+1. We get the flag by requesting `http://10.0.2.15/?page=../../../../../../../etc/passwd`
+
+## Fix
+
+The problem is letting users directly input files to be included/read. Such input must be sanitized, with for example a strict list of allowed values, or rejecting input containing `../`.