the-web-application-hackers-handbook

Chapter 10 n Attacking Back-End Components 373
HACK STEPS
1. If the application function you are attacking provides read access to a file,
attempt to access a known world-readable file on the operating system in
question. Submit one of the following values as the filename parameter
you control:
../../../../../../../../../../../../etc/passwd
../../../../../../../../../../../../windows/win.ini
If you are lucky, your browser displays the contents of the file you have
requested, as shown in Figure 10-5.
2. If the function you are attacking provides write access to a file, it may be
more difficult to verify conclusively whether the application is vulnerable.
One test that is often effective is to attempt to write two files — one
that should be writable by any user, and one that should not be writable
even by root or Administrator. For example, on Windows platforms you
can try this:
../../../../../../../../../../../../writetest.txt
../../../../../../../../../../../../windows/system32/config/sam
On UNIX-based platforms, files that root may not write are versiondependent,
but attempting to overwrite a directory with a file should
always fail, so you can try this:
../../../../../../../../../../../../tmp/writetest.txt
../../../../../../../../../../../../tmp
For each pair of tests, if the application’s behavior is different in
response to the first and second requests (for example, if the second
returns an error message but the first does not), the application probably
is vulnerable.
3. An alternative method for verifying a traversal flaw with write access is
to try to write a new file within the web root of the web server and then
attempt to retrieve this with a browser. However, this method may not
work if you do not know the location of the web root directory or if the
user context in which the file access occurs does not have permission to
write there.