metasploit-framework/http_traversal.md at master

1.9 KiB

Raw Permalink Blame History

Vulnerable Application

This module allows you to test if a web server (or web application) is vulnerable to directory traversal.

Setup

Install php and apache on your machine
Remove everything in /var/www/html/

Create /var/www/html/index.php with the following contents

<?php
$p = 'home.php';
if (isset($_GET['p']))
    $p = $_GET['p'];
include ($p);
?>

Create /var/www/html/home.php with the following contents

<!DOCTYPE html>
<html>
<head>
    <title>Hello, World!</title>
</head>
<body>
    <a href="?p=home.php">home</a>
</body>
</html>

Run the following command: sudo systemctl start apache2.service

Verification Steps

Install the application
Start msfconsole
Do: use auxiliary/scanner/http/http_traversal
Do: set rhosts <rhost>
Do: set path <filepath>
Do: run

Options

DATA

HTTP body data to send in the request

DEPTH

Directory traversal depth (default: 5)

FILELIST

File containing list of files to bruteforce for (default: /usr/share/metasploit-framework/data/wordlists/sensitive_files.txt)

METHOD

HTTP request method to use (default: GET)

PATH

Vulnerable path. Ex: /foo/index.php?pg= (default: /)

PATTERN

Regexp pattern to determine successful directory traversal (default: ^HTTP/\d\.\d 200)

Scenarios

Apache/2.4.57 on Kali GNU/Linux Rolling 2023.3

msf6 > use auxiliary/scanner/http/http_traversal
msf6 auxiliary(scanner/http/http_traversal) > set rhosts 127.0.0.1
rhosts => 127.0.0.1
msf6 auxiliary(scanner/http/http_traversal) > set path /?p=
path => /?p=
msf6 auxiliary(scanner/http/http_traversal) > run

[*] Running action: CHECK...
[+] Found trigger: ../
[+] Directory traversal found: ../
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

1.9 KiB Raw Permalink Blame History