Pen Test Labs Notes
PentesterLab provides two free exercises every month. This post is to record some interesting ones I have been done.
- https://pentesterlab.com/exercises
API 18
if !strings.HasSuffix(r.URL.String(), "health") && claims.Username != "admin" { http.Error(w, "You don't have access to the key", http.StatusUnauthorized) return }Directory Traversal 01
Directory Traversals
Directory traversals come from a lack of filtering/encoding of information used as part of a path by an application.
As with other vulnerabilities, you can use the "same-value technique" to test for this type of issue.
For example, if the path used by the application inside a parameter is /images/photo.jpg. You can try to access:
/images/./photo.jpg: you should see the same file./images/../photo.jpg: you should get an error./images/../images/photo.jpg: you should see the same file again./images/../IMAGES/photo.jpg: you should get an error (depending on the file system), or something weird is going on.
If you don't have the value images and the legitimate path looks like photo.jpg, you will need to work out what the parent repository is.
Once you have tested that, you can try to retrieve other files.
On Linux/Unix the most common test case is the /etc/passwd.
You can test: images/../../../../../../../../../../../etc/passwd
If you get the passwd file, the application is vulnerable. The good news is that you don't need to know the number of ... If you put too many, it will still work.
Another interesting thing to know is that if you have a directory traversal in Windows, you will be able to access test/../../../file.txt, even if the directory test does not exist.
This is not the case on Linux.
This can be really useful where the code concatenates user-controlled data, to create a file name.
For example, the following PHP code is supposed to add the parameter id to get a file name (example_1.txt for example).
On Linux, you won't be able to exploit this vulnerability if there is no directory starting with example_, whereas on Windows, you will be able to exploit it, even if there is no such directory.
In these exercises, the vulnerabilities are illustrated by a script used inside an <img tag.
You will need to read the HTML source (or use "Copy image URL") to find the correct link, and start exploiting the issue.
The first example is a really simple directory traversal. You just need to go up in the file system, and then back down, to get any files you want. In this instance, you will be restricted by the file system permissions, and won't be able to access /etc/shadow, for example.
In this example, based on the header sent by the server, your browser will display the content of the response. Sometimes the server will send the response with a header Content-Disposition: attachment, and your browser will not display the file directly. You can open the file to see the content. This method will take you some time for every test.
Using a Linux/Unix system, you can do this more quickly, by using wget or curl.
The objective of this exercise is to find the directory traversal and retrieve the key in the following file: /pentesterlab.key
- https://i.51sec.org/2025/chrome_fMjzra75Wa.png
- https://i.51sec.org/././2025/chrome_fMjzra75Wa.png
- https://i.51sec.org/../../../../../2025/chrome_fMjzra75Wa.png
- https://i.51sec.org/../../../../../pentesterlab.key
- https://netsec.libcurl.me/file.php?file=../../../../../../../../../etc/passwd
Videos
共有 0 条评论