Difference between revisions of "Relative Path Traversal"

From OWASP
Jump to: navigation, search
m (Categories)
Line 18: Line 18:
 
  <nowiki> http://some_site.com.br/../../../../etc/shadow  </nowiki>
 
  <nowiki> http://some_site.com.br/../../../../etc/shadow  </nowiki>
 
  <nowiki> http://some_site.com.br/get-files?file=../../../../etc/passwd </nowiki>
 
  <nowiki> http://some_site.com.br/get-files?file=../../../../etc/passwd </nowiki>
 
  
 
==Related Threats==
 
==Related Threats==
Line 25: Line 24:
  
 
==Related Attacks==
 
==Related Attacks==
 +
 
*[[Path Manipulation]]
 
*[[Path Manipulation]]
 
*[[ Path Traversal]]
 
*[[ Path Traversal]]
 
*[[ Resource Injection]]
 
*[[ Resource Injection]]
 
  
 
==Related Vulnerabilities==
 
==Related Vulnerabilities==
 
[[:Category:Input Validation Vulnerability]]
 
[[:Category:Input Validation Vulnerability]]
 
  
 
==Related Countermeasures==
 
==Related Countermeasures==
Line 38: Line 36:
  
  
==Categories==
+
[[Category: Resource Manipulation]]
[[:Category: Resource Manipulation]]
+
 
 +
[[Category: Attack]]

Revision as of 11:55, 5 November 2007

This is an Attack. To view all attacks, please see the Attack Category page.


This attack is a variant of Path Traversal and can be exploited when the application accepts the use of relative traversal sequences such as "../".

More detailed information can be found on Path_Traversal

Examples

The following URLs are vulnerable to this attack:

 http://some_site.com.br/get-files.jsp?file=report.pdf  
 http://some_site.com.br/get-page.php?home=aaa.html  
 http://some_site.com.br/some-page.asp?page=index.html  

A simple way to execute this attack is like this:

 http://some_site.com.br/get-files?file=../../../../some dir/some file  
 http://some_site.com.br/../../../../etc/shadow  
 http://some_site.com.br/get-files?file=../../../../etc/passwd 

Related Threats

Category: Information Disclosure

Related Attacks

Related Vulnerabilities

Category:Input Validation Vulnerability

Related Countermeasures

Category:Input Validation