Encoding Special Characters
Having honed our understanding of directory traversal concepts
using the “Mountain Desserts” web application,
let’s try applying these skills to a real vulnerability.
In the “Vulnerability Scanning” topic, we scanned the SAMBA machine
and identified a directory traversal vulnerability.
This vulnerability can be exploited by using a relative path after specifying
the cgi-bin directory in the URL.
Let’s use curl to try exploiting this directory traversal vulnerability.
After attempting two queries,
we could not display the contents of /etc/passwd via directory traversal.
Because leveraging ../ is a known way to abuse web application behavior,
this sequence is often filtered by either the web server,
web application firewalls, or the web application itself.
Fortunately for us, we can use URL Encoding,
also called Percent Encoding, to potentially bypass these filters.
For now, we will only encode the dots, which are represented as “%2e”.
We have successfully used directory traversal with encoded dots to display
the contents of /etc/passwd.
Generally, URL encoding is used to convert characters of a web request into a format
that can be transmitted over the internet.
However, it is also a popular method used for malicious purposes.
The reason for this is that the encoded representation of characters in a request
may be missed by filters, which only check for the plain-text representation of them.
After the request passes the filter,
the web application or server interprets the encoded characters as a valid request.