Projects/OWASP Path Traverser - Revision history

Tal Mel at 12:13, 8 October 2013

2013-10-08T12:13:00Z

Tal Mel at 12:09, 8 October 2013

2013-10-08T12:09:26Z

Tal Mel at 12:08, 8 October 2013

2013-10-08T12:08:04Z

Tal Mel at 09:52, 13 September 2013

2013-09-13T09:52:17Z

Tal Mel at 11:06, 29 August 2013

2013-08-29T11:06:18Z

Tal Mel at 10:46, 29 August 2013

2013-08-29T10:46:26Z

Tal Mel at 09:57, 29 August 2013

2013-08-29T09:57:58Z

Tal Mel at 09:54, 29 August 2013

2013-08-29T09:54:17Z

Samantha Groves: Created page with "{{Template:Project About | project_name =OWASP Path Traverser | project_home_page =OWASP_Path_Traverser | project_description =Path Traverser is a tool for security testing of..."

2012-08-08T17:53:40Z

Created page with "{{Template:Project About | project_name =OWASP Path Traverser | project_home_page =OWASP_Path_Traverser | project_description =Path Traverser is a tool for security testing of..."

New page

{{Template:Project About
| project_name =OWASP Path Traverser
| project_home_page =OWASP_Path_Traverser
| project_description =Path Traverser is a tool for security testing of web applications.
It simulates a real Path Traversal attack, only with actual existing files.

It operates as a middleman between the web application to its host server, which gives the abillity to test the actual files as found in the host server against the application, according to their relevant path.

After you have provided the relevant details, Path Traverser will connect (FTP) to your host server in order to pull out the list of files.
Then, it manipulates the list taken from the file system so it will fit the web application by changing their paths.

If your application could be found at: http://mysrvr:777/home
and the application files could be found in the file system under: myapps/demoapp/client/version/lastversion/, requests for files under: /myapps/demoapp/client/version/1.1/ will be created as: http://mysrvr:777/home/../1.1/ and requests for files under/myapp/differentapp/files/ will be created as: http://mysrvr:777/home/../../../../differentapp/files/, etc...

After that, the Path Traverser will start sending these requests one by one and log the results by the HTTP Response code selected.

A configuration for excluding/including specific file types is available.
| project_license =Attribution-NonCommercial-NoDerivs 3.0 Unported (CC BY-NC-ND 3.0
| leader_name1 =Tal Melamed
| leader_email1 =Tal.Melamed@owasp.org
| mailing_list_name = https://lists.owasp.org/mailman/listinfo/owasp_path_traverser
| project_road_map = https://www.owasp.org/index.php/Projects/OWASP_Path_Traverser/Roadmap
}}

← Older revision		Revision as of 12:13, 8 October 2013
Line 27:		Line 27:
	\| project_road_map = https://www.owasp.org/index.php/Projects/OWASP_Path_Traverser/Roadmap		\| project_road_map = https://www.owasp.org/index.php/Projects/OWASP_Path_Traverser/Roadmap
	}}		}}
−
−	~~<span style="color:#FFFFFF"> <html><head><meta name="google-site-verification" content="9aTMIOmVPfhPrsnHycIrRpX60j1BRXXI55E9efJRIcw" /></head></html></span>~~

← Older revision		Revision as of 12:09, 8 October 2013
Line 28:		Line 28:
	}}		}}

−	<span style="color:#FFFFFF"> <meta name="google-site-verification" content="9aTMIOmVPfhPrsnHycIrRpX60j1BRXXI55E9efJRIcw" /></span>	+	<span style="color:#FFFFFF"> <html><head><meta name="google-site-verification" content="9aTMIOmVPfhPrsnHycIrRpX60j1BRXXI55E9efJRIcw" /></head></html></span>

← Older revision		Revision as of 12:08, 8 October 2013
Line 27:		Line 27:
	\| project_road_map = https://www.owasp.org/index.php/Projects/OWASP_Path_Traverser/Roadmap		\| project_road_map = https://www.owasp.org/index.php/Projects/OWASP_Path_Traverser/Roadmap
	}}		}}
		+
		+	<span style="color:#FFFFFF"> <meta name="google-site-verification" content="9aTMIOmVPfhPrsnHycIrRpX60j1BRXXI55E9efJRIcw" /></span>

← Older revision		Revision as of 09:52, 13 September 2013
Line 1:		Line 1:
		+	[[File:Path_traverser_icon.jpg]]
		+
	{{Template:Project About		{{Template:Project About
	\| project_name ='''OWASP Path Traverser'''		\| project_name ='''OWASP Path Traverser'''

@@ Line 4: / Line 4: @@
 | project_description =Path Traverser is a tool for security testing of web applications.
-[[File:http://appsec.it/pt/images/logo1.png]]
+'''Path Traverser''' simulates a real Path Traversal attack, only with actual existing files
 It operates as a middleman between the web application to its host server, which gives the abillity to test the actual files as found in the host server against the application, according to their relevant path.

@@ Line 15: / Line 15: @@
 After that, the Path Traverser will start sending these requests one by one and log the results by the HTTP Response code selected.
-A configuration for excluding/including specific file types is available.
+Configurations for excluding/including specific file types, Headers, HTTP Responses and more are available to optimize your tests...
 | project_license =Attribution 3.0 Unported (CC BY 3.0)
 | leader_name1 =Tal Melamed
 | leader_email1 =Tal.Melamed@owasp.org

@@ Line 1: / Line 1: @@
 {{Template:Project About
-| project_name =OWASP Path Traverser
+| project_name ='''OWASP Path Traverser'''
 | project_home_page =OWASP_Path_Traverser
 | project_description =Path Traverser is a tool for security testing of web applications.
@@ Line 7: / Line 7: @@
 It operates as a middleman between the web application to its host server, which gives the abillity to test the actual files as found in the host server against the application, according to their relevant path.
-After you have provided the relevant details, Path Traverser will connect (FTP) to your host server in order to pull out the list of files.
+After you have provided the relevant details, Path Traverser will connect (sFTP/SSH) to your host server in order to pull out the list of files.
 Then, it manipulates the list taken from the file system so it will fit the web application by changing their paths.
-If your application could be found at: http://mysrvr:777/home
+If your application could be found at: ''<nowiki>http://mysrvr:777/home</nowiki>''
-and the application files could be found in the file system under: myapps/demoapp/client/version/lastversion/, requests for files under: /myapps/demoapp/client/version/1.1/ will be created as: http://mysrvr:777/home/../1.1/ and requests for files under/myapp/differentapp/files/ will be created as: http://mysrvr:777/home/../../../../differentapp/files/, etc...
+and the application files could be found in the file system under: ''myapps/demoapp/client/version/lastversion''/, requests for files under: ''/myapps/demoapp/client/version/1.1/'' will be created as: ''<nowiki>http://mysrvr:777/home/../1.1/</nowiki>''  and requests for files under: ''/myapp/differentapp/files/'' will be created as: ''<nowiki>http://mysrvr:777/home/../../../../differentapp/files/</nowiki>'' , etc...
 After that, the Path Traverser will start sending these requests one by one and log the results by the HTTP Response code selected.
 A configuration for excluding/including specific file types is available.
-| project_license =Attribution-NonCommercial-NoDerivs 3.0 Unported (CC BY-NC-ND 3.0
+| project_license =Attribution 3.0 Unported (CC BY 3.0)
 | leader_name1 =Tal Melamed
 | leader_email1 =Tal.Melamed@owasp.org