the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 833
7.4.5 If you believe that your input is being passed to an OS command of
some kind, but the attack strings listed are unsuccessful, see if you can
use the < or > character to direct the contents of a file to the command’s
input or to direct the command’s output to a file. This may enable you
to read or write arbitrary file contents. If you know or can guess the
actual command being executed, try injecting command-line parameters
associated with that command to modify its behavior in useful ways
(for example, by specifying an output file within the web root).
7.4.6 If you find that the application is escaping certain key characters you need
to perform a command injection attack, try placing the escape character
before each such character. If the application does not escape the escape
character itself, this usually leads to a bypass of this defensive measure.
If you find that whitespace characters are blocked or sanitized, you may
be able to use $IFS in place of spaces on UNIX-based platforms.
7.5 Test for Path Traversal
7.5.1 For each fuzz test you have performed, review the results generated
by the path traversal attack strings listed in step 7.1.3. You can click the
top of the payload column in Burp Intruder to sort the results table by
payload and group the results for these strings. For any cases where
an unusual error message or a response with an abnormal length was
received, review the response manually to determine whether it contains
the contents of the specified file or other evidence that an anomalous
file operation occurred.
7.5.2 In your mapping of the application’s attack surface, you should have
noted any functionality that specifically supports the reading and writing
of files on the basis of user-supplied input. In addition to the general
fuzzing of all parameters, you should manually test this functionality
very carefully to identify any path traversal vulnerabilities that exist.
7.5.3 Where a parameter appears to contain a filename, a portion of a filename,
or a directory, modify the parameter’s existing value to insert an
arbitrary subdirectory and a single traversal sequence. For example, if
the application submits this parameter:
file=foo/file1.txt
try submitting this value:
file=foo/bar/../file1.txt
If the application’s behavior is identical in the two cases, it may be
vulnerable, and you should proceed to the next step. If the behavior
is different, the application may be blocking, stripping, or sanitizing