diff options
Diffstat (limited to 'Directory traversal/Resources/notes.md')
| -rw-r--r-- | Directory traversal/Resources/notes.md | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/Directory traversal/Resources/notes.md b/Directory traversal/Resources/notes.md new file mode 100644 index 0000000..d4068b8 --- /dev/null +++ b/Directory traversal/Resources/notes.md @@ -0,0 +1,8 @@ +## Exploit + +1. Pages being fetched with a query parameter `page` (`http://10.0.2.15/?page=somePage`) expose the server to dot-dot-slash attack. +1. We get the flag by requesting `http://10.0.2.15/?page=../../../../../../../etc/passwd` + +## Fix + +The problem is letting users directly input files to be included/read. Such input must be sanitized, with for example a strict list of allowed values, or rejecting input containing `../`. |