This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Relative Path Traversal"
From OWASP
m (→Categories) |
|||
| Line 18: | Line 18: | ||
<nowiki> http://some_site.com.br/../../../../etc/shadow </nowiki> | <nowiki> http://some_site.com.br/../../../../etc/shadow </nowiki> | ||
<nowiki> http://some_site.com.br/get-files?file=../../../../etc/passwd </nowiki> | <nowiki> http://some_site.com.br/get-files?file=../../../../etc/passwd </nowiki> | ||
| − | |||
==Related Threats== | ==Related Threats== | ||
| Line 25: | Line 24: | ||
==Related Attacks== | ==Related Attacks== | ||
| + | |||
*[[Path Manipulation]] | *[[Path Manipulation]] | ||
*[[ Path Traversal]] | *[[ Path Traversal]] | ||
*[[ Resource Injection]] | *[[ Resource Injection]] | ||
| − | |||
==Related Vulnerabilities== | ==Related Vulnerabilities== | ||
[[:Category:Input Validation Vulnerability]] | [[:Category:Input Validation Vulnerability]] | ||
| − | |||
==Related Countermeasures== | ==Related Countermeasures== | ||
| Line 38: | Line 36: | ||
| − | + | [[Category: Resource Manipulation]] | |
| − | [[ | + | |
| + | [[Category: Attack]] | ||
Revision as of 16:55, 5 November 2007
- This is an Attack. To view all attacks, please see the Attack Category page.
This attack is a variant of Path Traversal and can be exploited when the application accepts the use of relative traversal sequences such as "../".
More detailed information can be found on Path_Traversal
Examples
The following URLs are vulnerable to this attack:
http://some_site.com.br/get-files.jsp?file=report.pdf http://some_site.com.br/get-page.php?home=aaa.html http://some_site.com.br/some-page.asp?page=index.html
A simple way to execute this attack is like this:
http://some_site.com.br/get-files?file=../../../../some dir/some file http://some_site.com.br/../../../../etc/shadow http://some_site.com.br/get-files?file=../../../../etc/passwd
Related Threats
Category: Information Disclosure
Related Attacks
Related Vulnerabilities
Category:Input Validation Vulnerability
