Questions About Directory Traversal

Question

I am working on this problem:

https://www.hackthissite.org/missions/realistic/3/

The site above has been hacked and it is our job to return it back to its original state. I started by looking at the source code. The hacker left a comment reading:

"Note to the webmasterThis website has been hacked, but not totally destroyed. The old website is still up. I simply copied the old index.html file to oldindex.html and remade this one. Sorry about the inconvenience."

Therefore I went to https://www.hackthissite.org/missions/realistic/3/oldindex.html

I then clicked on submit poetry. In the name field I put ../index.html and in the poem field I put the source code of the page:

www(dot)hackthissite.org(dot)missions/realistic/3/oldindex(dot)html.

I got the right answer; however, I don't quite get how this works.

1. First of all how do you know when something is susceptible to directory traversal. I did it because I looked at the forums, but how would I know that directory traversal is an option?

2. If you click on read poem --> 'poem name' you get a url like this:

   www(dot)hackthissite(dot)org/missions/realistic/3/readpoem(dot)php?name=The%20Idiot

   In that case wouldn't the final url using ../index.html be:

   www(dot)hackthissite(dot)org/missions/realistic/3/?name=index(dot)html

   not www(dot)hackthissite(dot)org/missions/realistic/3/index(dot)html

Sory for the (dot). I need more reputation to post more links.

Answer 1

During a directory traversal attack, the attacker will submit a filename contaning characters that will allow them to access files outside of the intended directory. For example a single dot (.) refferes to the current directory and two dots (..) the parent directory. During an attack the aim will be to access and read restricted files using PHP's elevated privileges.

This is an example of directory transversal vulnerable php code:

$page = $_GET['page'];
$filename = "/pages/$page";
$file_handler = fopen($filename, "r");  
$contents = fread($file_handler, filesize($file)); 
fclose($file_handler); 
echo $contents;

In your challenge the file: "readpoem.php" is vulnerable in his $_GET['name'] variable and its happening something similar.

In a blackbox pentesting you can detect it by following errors produced when fuzzing a value and analyzing your request/respond traffic.

en.wikipedia.org/wiki/Fuzz_testing

One type of solution to prevent this is checking for "forbidden" occurrences as someone put an example here: Preventing Directory Traversal in PHP but allowing paths