Testing Directory Traversal File Include
Directory traversal, also known as path traversal, file include is where an attacker looks to exploit a lack of input validation or weakly deployed methods to read or write files that are not authorized or warranted to be accessible. In this recipe, we will discover the method of how attackers conduct such an attack, which is known as the “dot dot slash” (../) attack.
Getting ready
To start, ensure that ZAP is started and use the PortSwigger Academy lab, File path traversal, simple case.
How to do it…
To determine which part of the application is vulnerable to input validation bypassing, you need to enumerate all parts of the application that accept content from the user’s perspective. This includes HTTP GET and POST queries and common options such as file uploads and HTML forms. Let’s look at the steps:
- Capture the web application in ZAP.
- Spider the web application and look for any...
