OK, so another type of directory traversal allows us to read the content of any file.
So are these such bugs we need to climb and traverse between folders again.
So we'll go to county and log in to be Web.
Open directory traversal file from the menu above.
And here's a sample page.
As you can see, there's nothing with the page itself.
So this means that you've got to pay attention.
To the you are l just like the previous lessem.
Now, it's easy to guess that this time the application displays the content of the file passes page
parameter, right.
And call the magic file slash ATC slash password.
And here's the content of the file, see how perfect this is.
So now we can try to climb to reach that same file.
Climb up one more level.
Now, then climb up more again, no, and climb up one more level.
Oh, there it is.
So over this kind of traversal attack, we can use it to end called dot, dot, own.
Now, it's very easy to use, but first we do need to capture the request.
So enable Foxe proxy.
Then open berp in interception mode.
I'm just going to rearrange the screens for a little bit of you.
OK, so now refresh the page.
And here is a request in berp.
So now I'm going to change here to the string traversal.
And copy this request to a file.
And let's call it DTT and save.
OK, good.
So now go to your terminal, simply type dot, dot, PWI in and we'll look at the options.
And the options are very clear, so let's run, dot, dot, own against BEA Web.
Type dot dot P.W. N. m payload.
So the mm parameter is used, you specify the module.
Now, because we're going to use the berp output, we should choose this module.
And then H for the name of the host.
And P for the burbs output file.
Oh, Eunuch's, you can use this parameter if you know the target operating system, it's not necessarily
necessary and f etsi password, so it is you can look for a specific file on the target file system.
Told you earlier I like the password.
The three to specify the depth of the payload.
And X 80, and that specifies a port No.
So finally be to quit after the first vulnerability's found.
OK, so now we can hit enter.
Oh, dear.
Something went wrong.
Let me just have a look quickly.
And OK, yeah, so I forgot to add a parameter, the parameter K, so add K root.
To make the tool understand if it is able to read the final content or not.
OK, then go.
And it discovered the traversal.
And as you can see, it detects the same way we do three consecutive climbs.
Now I'm going to exclude the parameter B.
So this time it's going to discover as many payloads as it can.
All right, so it finds three different versions of payload.
OK, so then go to the Web browser again.
Disable Foxe proxy.
And now change it to a medium level.
So I'm going to add the path that we used before.
OK, so it doesn't work.
OK, so I can delete the first two placeholders.
And it works pretty well, huh?
And for the last level.
I will add the same payload.
And it doesn't work.
OK, so to be honest, I was waiting for this result.
I'm not surprised.
But I want to set it up on purpose, obviously, but I want to show you another trick to use here.
The final protocols.
So type file Colin Haggar, slash etsi slash password, and there you have it.
OK, so I want to show you the vulnerable code as well, but it really isn't actually very different
than the first one, so I'm going to leave it for you to look at.
All right.
Good job.