https://github.com/sjord/protravel
Recursively exploit path traversal vulnerability
https://github.com/sjord/protravel
exploit python3
Last synced: 8 days ago
JSON representation
Recursively exploit path traversal vulnerability
- Host: GitHub
- URL: https://github.com/sjord/protravel
- Owner: Sjord
- Created: 2018-08-06T15:22:26.000Z (almost 7 years ago)
- Default Branch: master
- Last Pushed: 2022-06-13T14:00:11.000Z (almost 3 years ago)
- Last Synced: 2025-05-08T03:52:17.458Z (8 days ago)
- Topics: exploit, python3
- Language: Python
- Homepage: https://www.sjoerdlangkemper.nl/2018/08/15/automating-path-traversal-with-protravel/
- Size: 12.7 KB
- Stars: 7
- Watchers: 4
- Forks: 5
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
## Protravel
### Path traversal
Directory traversal or path traversal makes it possible to access any file on the webserver. For example, consider the following URL vulnerable:
http://example.com/getfile.php?filename=export2018.csv
Then the following URL may return /etc/passwd from the server:
http://example.com/getfile.php?filename=../../../../../../etc/passwd
We use `../` to go a directory up and download a file outside of the directory that getfile.php normally reads the exports from.
With path traversal it is generally possible to download any file by name, but not possible to get any directory listings. This means that we have to guess filenames if we want to download them. That is the task that protravel performs.
### Finding filenames
Protravel contains a list of interesting files to download. Some of these files, especially log files, contain paths of other files. Protravel will download these, and in this way try to spider the filesystem.
It can also parse /etc/passwd to read the home directories from it, and search for .ssh and .bashrc files in home directories.
### Usage
Call protravel with a URL as argument. The path to download will be appended to the URL.
protravel.py http://example.com/getfile.php?filename=../../../../..
All found files are written to a directory, `out` by default.