Talk:Directory traversal attack
Add topic | This article is rated Start-class on Wikipedia's content assessment scale. It is of interest to the following WikiProjects: | ||||||||||||||||||
| |||||||||||||||||||
I have tagged this for clean-up. There is a good content here, but can someone bring it out? :-)
Paulc1001 12:45, 8 October 2005 (UTC)
Will try within the next few days
--Blaufish 22:16, 15 December 2005 (UTC)
"Current Method Also Known As (Return Flushing, RE Exploit)" This entire section is very confusing, can anyone clear this up?
Not sure what to do what to do about that one. It is confusing me too.
--Blaufish 16:01, 24 May 2006 (UTC)
Me too. I can't find an independent mention of "return flushing" on the Internet, and the author has not stepped forward to explain. Thus, I am moving the section to the talk page. Hashproduct 02:10, 29 November 2006 (UTC)
- Current Method Also Known As (Return Flushing, RE Exploit)
- Due to most vulnerabilities being recently patched as such sites as http://milw0rm.com have been released publicly, most attackers have been forced to develop exploits of their own. One such method is return flushing, or re'ing. This attempt consist of a parallel paradox. On the attackers computer, the request points to a file that does exist in the directory specified. Usually the attacker specially configures his or her own directories so they are unique and are rarely affiliated with the server's directories. The file usually included in the get request is cmd.exe, or other shell applications. The failed get request results in a resolvement, bypassing the typical 404 error and/or 403 error pages, and resolves the request to the base of the domain/server, revealing all the content resideing within the domain/server. No matter what utility/environment is being utilized the domain/server. This accounts for several environments such as Apache.
In the section 'Possible Methods to Prevent Directory Traversal' I think there is an additional requirement for the algorithm - that the Document Root ends with a directory/folder delimiter (ie '/' or '\' depending on the platform), otherwise it would be possible to navigate to some locations outside the Document Root, eg if Document Root is /var/www then the algorithm allows access to /var/www_logs
—Preceding unsigned comment added by R0bd (talk • contribs) 15:48, 17 November 2009 (UTC)