Awsome yet unlucky path traversalWhere to find a fake hierarchy for a honeypot for double-dot/path traversal...

Is a party consisting of only a bard, a cleric, and a warlock functional long-term?

What options are left, if Britain cannot decide?

What has been your most complicated TikZ drawing?

Is it normal that my co-workers at a fitness company criticize my food choices?

How to read the value of this capacitor?

Could the Saturn V actually have launched astronauts around Venus?

What's the meaning of “spike” in the context of “adrenaline spike”?

Why doesn't the EU now just force the UK to choose between referendum and no-deal?

Time travel from stationary position?

It's a yearly task, alright

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

how to write formula in word in latex

Why would a flight no longer considered airworthy be redirected like this?

What is the significance behind "40 days" that often appears in the Bible?

Does Mathematica reuse previous computations?

Brexit - No Deal Rejection

Do I need to be arrogant to get ahead?

Co-worker team leader wants to inject his friend's awful software into our development. What should I say to our common boss?

What are substitutions for coconut in curry?

Are there verbs that are neither telic, or atelic?

Why do Australian milk farmers need to protest supermarkets' milk price?

If curse and magic is two sides of the same coin, why the former is forbidden?

Happy pi day, everyone!

Life insurance that covers only simultaneous/dual deaths



Awsome yet unlucky path traversal


Where to find a fake hierarchy for a honeypot for double-dot/path traversal attacks?Danger of Path Traversal AttacksFinding Directory traversal vulnerabilityAlternative ways to exploit this path traversalPath traversal exploitExecute cmd commands with http directory traversal attackWhat is the most valuable file you can get using a directory traversal holeIs jQuery 2.1.1 vulnerable to OS command injection?On company intranet yet web server picked up URL scanning-type requests?Preventing Path Traversal Best Practise?













3















I am performing a penetration testing on an application hosted on an Ubuntu environment.



So using a path traversal vulnerability, I can download any file.



The API web application runs as root (shadow and brute-force are already my friends). Funny situation: I can not find the web root folder.



What I have tried:




  • Search for logs that can lead me to the path. nginx or apache2 is not there.

  • Search for nginx, apache2 or other configuration files

  • Search for common directories of web roots (https://serverfault.com/questions/144598/where-should-the-web-server-root-directory-go-in-linux)

  • Bash histories of all users


What else should I try?










share|improve this question























  • What about the /opt location?

    – Jeroen - IT Nerdbox
    3 hours ago











  • @Jeroen-ITNerdbox no luck :)

    – Lucian Nitescu
    3 hours ago











  • @hiburn8 "Bash histories of all users"

    – Lucian Nitescu
    2 hours ago
















3















I am performing a penetration testing on an application hosted on an Ubuntu environment.



So using a path traversal vulnerability, I can download any file.



The API web application runs as root (shadow and brute-force are already my friends). Funny situation: I can not find the web root folder.



What I have tried:




  • Search for logs that can lead me to the path. nginx or apache2 is not there.

  • Search for nginx, apache2 or other configuration files

  • Search for common directories of web roots (https://serverfault.com/questions/144598/where-should-the-web-server-root-directory-go-in-linux)

  • Bash histories of all users


What else should I try?










share|improve this question























  • What about the /opt location?

    – Jeroen - IT Nerdbox
    3 hours ago











  • @Jeroen-ITNerdbox no luck :)

    – Lucian Nitescu
    3 hours ago











  • @hiburn8 "Bash histories of all users"

    – Lucian Nitescu
    2 hours ago














3












3








3








I am performing a penetration testing on an application hosted on an Ubuntu environment.



So using a path traversal vulnerability, I can download any file.



The API web application runs as root (shadow and brute-force are already my friends). Funny situation: I can not find the web root folder.



What I have tried:




  • Search for logs that can lead me to the path. nginx or apache2 is not there.

  • Search for nginx, apache2 or other configuration files

  • Search for common directories of web roots (https://serverfault.com/questions/144598/where-should-the-web-server-root-directory-go-in-linux)

  • Bash histories of all users


What else should I try?










share|improve this question














I am performing a penetration testing on an application hosted on an Ubuntu environment.



So using a path traversal vulnerability, I can download any file.



The API web application runs as root (shadow and brute-force are already my friends). Funny situation: I can not find the web root folder.



What I have tried:




  • Search for logs that can lead me to the path. nginx or apache2 is not there.

  • Search for nginx, apache2 or other configuration files

  • Search for common directories of web roots (https://serverfault.com/questions/144598/where-should-the-web-server-root-directory-go-in-linux)

  • Bash histories of all users


What else should I try?







web-application penetration-test webserver operating-systems web-service






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked 3 hours ago









Lucian NitescuLucian Nitescu

1,287416




1,287416













  • What about the /opt location?

    – Jeroen - IT Nerdbox
    3 hours ago











  • @Jeroen-ITNerdbox no luck :)

    – Lucian Nitescu
    3 hours ago











  • @hiburn8 "Bash histories of all users"

    – Lucian Nitescu
    2 hours ago



















  • What about the /opt location?

    – Jeroen - IT Nerdbox
    3 hours ago











  • @Jeroen-ITNerdbox no luck :)

    – Lucian Nitescu
    3 hours ago











  • @hiburn8 "Bash histories of all users"

    – Lucian Nitescu
    2 hours ago

















What about the /opt location?

– Jeroen - IT Nerdbox
3 hours ago





What about the /opt location?

– Jeroen - IT Nerdbox
3 hours ago













@Jeroen-ITNerdbox no luck :)

– Lucian Nitescu
3 hours ago





@Jeroen-ITNerdbox no luck :)

– Lucian Nitescu
3 hours ago













@hiburn8 "Bash histories of all users"

– Lucian Nitescu
2 hours ago





@hiburn8 "Bash histories of all users"

– Lucian Nitescu
2 hours ago










1 Answer
1






active

oldest

votes


















4














Use the traversal vulnerability to read



/proc/self/environ


This prints out environment variables among other thread information.



Look for a environment variable called DOCUMENT_ROOT






share|improve this answer























    Your Answer








    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "162"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: false,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: null,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    noCode: true, onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f205470%2fawsome-yet-unlucky-path-traversal%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    4














    Use the traversal vulnerability to read



    /proc/self/environ


    This prints out environment variables among other thread information.



    Look for a environment variable called DOCUMENT_ROOT






    share|improve this answer




























      4














      Use the traversal vulnerability to read



      /proc/self/environ


      This prints out environment variables among other thread information.



      Look for a environment variable called DOCUMENT_ROOT






      share|improve this answer


























        4












        4








        4







        Use the traversal vulnerability to read



        /proc/self/environ


        This prints out environment variables among other thread information.



        Look for a environment variable called DOCUMENT_ROOT






        share|improve this answer













        Use the traversal vulnerability to read



        /proc/self/environ


        This prints out environment variables among other thread information.



        Look for a environment variable called DOCUMENT_ROOT







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered 2 hours ago









        DaisetsuDaisetsu

        4,21811021




        4,21811021






























            draft saved

            draft discarded




















































            Thanks for contributing an answer to Information Security Stack Exchange!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f205470%2fawsome-yet-unlucky-path-traversal%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            Popular posts from this blog

            “%fieldName is a required field.”, in Magento2 REST API Call for GET Method Type The Next...

            How to change City field to a dropdown in Checkout step Magento 2Magento 2 : How to change UI field(s)...

            變成蝙蝠會怎樣? 參考資料 外部連結 导航菜单Thomas Nagel, "What is it like to be a...