View source for Directory Traversal, File Inclusion (en)

==Directory Traversal and File Inclusion: Exploring the File System Unexpectedly==

==What is Directory Traversal?==

Directory traversal is a vulnerability in a web application where an attacker can manipulate user input to access files or directories outside of the ones they are supposed to access. Imagine you are walking around a mall, but you can go outside the designated path and enter restricted areas like a warehouse or control room.

==Simple Example:==

Suppose a web application has a feature to display a user's profile based on an ID. The URL might look like this:

http://example.com/profile?user=123

If the application does not properly validate the ''user'' input, an attacker can change the value of ''user'' to

../../../../etc/passwd

This way, the attacker can read the ''passwd'' file which contains sensitive information about the operating system user.

==What is File Inclusion?==

'''File inclusion''' is a vulnerability where an attacker can force a server to execute a file that it should not. This often occurs when a web application allows users to specify which files to include or require.

'''Types of File Inclusion:'''

* '''Local File Inclusion (LFI):''' The attacker forces the server to read and execute a file that resides on the same server.
* '''Remote File Inclusion (RFI):''' The attacker forces the server to read and execute a file from another server.

'''Simple Example:'''

Suppose a web application has a feature to display page content based on filename. The URL might look like this:

http://example.com/page?file=home

If the application does not properly validate the ''file'' input, an attacker can replace the ''file'' value with

../../../../etc/passwd

If the application uses the ''include'' or ''require'' functions to include files, then the `passwd` file will be read and displayed on the web page.

==Combination of Directory Traversal and File Inclusion==

Directory traversal attacks are often used as a first step to file inclusion attacks. Once an attacker has successfully located a file containing code, they can include the file to execute their own code.

'''Example Attack Scenario:'''

* '''Finding File Location:''' An attacker uses directory traversal to find the location of a PHP configuration file (php.ini) or a log file containing sensitive information.
* '''Reading File:''' An attacker reads the contents of a PHP configuration file to find out the directory where the PHP executable file is stored.
* '''Execute Code:''' Attackers use file inclusion to insert PHP files containing their own malicious code.

==Preventing Directory Traversal and File Inclusion==

* '''Validate Input:''' Always validate all user input to ensure that it is as expected.
* '''Whitelist:''' Create a whitelist of files and directories that are allowed to be accessed.
* '''Relativize Path:''' Use the functions provided by the programming language to create paths that are relative to the application directory.
* '''Disable Functions:''' Disable risky functions such as ''include'', ''require'', and ''eval'' if they are not needed.
* '''Chroot Jail:''' Restrict application access to the file system by using a chroot jail.

==Conclusion==

Directory traversal and file inclusion are two very common and dangerous vulnerabilities. By understanding how these attacks work, you can take the necessary steps to prevent them from happening to your web applications.

==Interesting Links==

* [[Ethical Hacking]]
* [[More complex exploit examples]]
* [[Tools used to detect this vulnerability]]
* [[How to test your web application for this vulnerability]]