-
Book Overview & Buying
-
Table Of Contents
Zed Attack Proxy Cookbook
By :
Directory traversal, also known as path traversal, file include is where an attacker looks to exploit a lack of input validation or weakly deployed methods to read or write files that are not authorized or warranted to be accessible. In this recipe, we will discover the method of how attackers conduct such an attack, which is known as the “dot dot slash” (../) attack.
To start, ensure that ZAP is started and use the PortSwigger Academy lab, File path traversal, simple case.
To determine which part of the application is vulnerable to input validation bypassing, you need to enumerate all parts of the application that accept content from the user’s perspective. This includes HTTP GET and POST queries and common options such as file uploads and HTML forms. Let’s look at the steps: