File transfer
Directory traversal
What is it?
Directory Traversal, also known as Path Traversal, is a vulnerability that allows an attacker to read files on the victim’s system by manipulating file paths used in the application.
A simple example:
A vulnerable web application may have the endpoint /get_file?path={filepath} When a request is made, the application returns the content of the specified file. If an attacker inserts a path into {filepath} such as ../../../etc/passwd, they might get access to the system files. The application then fetches this file, and if the file contents are sent in the response, the attacker can view sensitive system information.
Remember that a payload or attack may change depending on the application and the server's file system. Directory Traversal can often lead to:
Sensitive data exposure
System information disclosure
Other learning resources:
PortSwigger: https://portswigger.net/web-security/file-path-traversal
Checklist
Exploitation
Basic directory traversal
Reading application's own configuration files
Log exposure
Non-recursive filter bypass
Tools
Web Server
https://github.com/sc0tfree/updog
Install and run updog:
Simple Python HTTP server:
FTP Server
Start a Twisted FTP server:
From a victim to upload a file to your FTP server:
Example reverse-shell FTP script (create file then run):
TFTP Server
On Kali:
From a reverse-Windows shell (download netcat and execute):
Example vulnerable URL (shows using null byte to include logs and run nc.exe):
Windows — File Transfer Methods
Bitsadmin:
Certutil:
Powershell:
FTP (from a reverse shell — see FTP Server section above for full FTP script)
SMB Server
Run an SMB share using Impacket's smbserver:
Or configure Samba by editing /etc/samba/smb.conf (example configuration):
Set permissions and restart Samba:
From a victim machine with a reverse shell:
Download from SMB share:
Upload to SMB share:
VBScript downloader (create on the victim)
Create wget.vbs via echoed lines and execute:
Last updated