WebGoat Path Traversal 2 3 4

WebGoat Path Traversal 2

WebGoat path traversal 2 form

Path traversal vulnerabilities allow malicious users to read and/or write files and directories located outside the web root directory by means of the “../” path — https://owasp.org/www-community/attacks/Path_Traversal

File upload dialog

Let’s start by uploading an image

Upload completed

From the message at the bottom of the form I gather that the image has been uploaded to the specified location

Let’s see what the response tells us on Burp

Update action HTTP response

It seems that the name of the file is passed to the webapp by means of the “Full name” parameter, so let’s try to tamper with it on Burp Repeater

Update action on Burp Repeater

By changing the form data “fullName” it is possible to change the file name on the system

Path traversal vulnerability exploitation

So by passing a “fullName” parameter starting with ../ we complete the lesson

WebGoat Path Traversal 3

This lesson is very similar to the previous one, let’s upload a file and tamper with the request on Burp Repeater

Trying ../test as “fullNameFix” parameter

It seems that the webapp removes the ../ from the “fullNameFix” parameter, let’s try some part of the path traversal pattern

Trying ..test

If “fullNameFix” starts with .. the webapp allows it and the file name keeps the leading ..

Trying ./test

If “fullNameFix” starts with ./ the webapp allows it and the file name keeps the leading ./ that identifies the current directory, so the injection is successful but there is no harm done

Trying …./test

As expected, by trying …./ the webapp removes the malicious pattern but keeps the .. in front of the file name

Trying ../../test

Again, the webapp removes all occurrences of the ../ patterns and the file name does not retain anything from this injection

Trying …/./test

The webapp removes ../ but does not check the parameter recursively so the ../ pattern is removed from ..././ so I get ../ and the exercise is completed

Trying ….//test

Last test just to confirm the solution, from ….// we get ../

WebGoat Path Traversal 4

Same as before, let’s upload a file and see what happens on Burp

File name is taken from the uploaded file

This time it seems that the file name used to write the image to the disk is taken directly from the name of the file passed to the webapp

Trying ../test as file name

So by adding a leading ../ pattern to the file name we complete this exercise

This concludes WebGoat Path Traversal 2 3 4

I hope you liked it.

PVXs — https://twitter.com/pivixih