Testing for directory traversal
Directory traversal attacks are attempts to discover or force-browse unauthorized web pages usually designed for administrators of the application. If an application does not configure the web document root properly and does not include proper authorization checks on the server side for each page accessed, a directory traversal vulnerability may exist. This type of weakness allows an attack to perform system command injection exploitation or arbitrary code execution.
Getting ready
Using OWASP Mutillidae II as our target application, let’s determine whether it contains any directory traversal vulnerabilities.
Ensure that Burp Suite and the OWASP BWA VM are running, that Burp Suite is configured in the Firefox browser (or use the Burp Suite browser), and that you are viewing the OWASP BWA applications.
How to do it...
- From the OWASP BWA landing page, click the link to the OWASP Mutillidae II application.
- Open the login screen...
