当前位置：网站首页>[network security interview question] - how to penetrate the test file directory through

[network security interview question] - how to penetrate the test file directory through

2022-07-06 02:43:00 【LexSaints】

4.6. Directory traversal

4.6.1. brief introduction

Directory traversal （ Also known as directory traversal /directory traversal/path traversal） By using ../ And so on directory control sequence or file absolute path to access any file and directory stored on the file system , Especially the application source code 、 The configuration file 、 Important system files, etc .

4.6.2. Attack load

4.6.2.1. URL Parameters

  • ../
  • ..\
  • ..;/

4.6.2.2. Nginx Off by Slash

  • https://vuln.site.com/files../

4.6.2.3. UNC Bypass

  • \\localhost\c$\windows\win.ini

4.6.3. Filter around

  • Single replacement

    • ...//
  • URL code

  • 16 position Unicode code

    • \u002e

  • Super long UTF-8 code

    • \%e0%40%ae

4.6.4. defense

In the process of file operation API front , User input should be filtered . Whitelist can be used under strong rules , Only alphanumeric characters are allowed .

If the rule allows more characters , It is best to use the current operating system path normalization function to normalize the path , To filter , Finally, make relevant calls .

4.6.5. Reference link

    Recommended reading

【 Resource Recommendation 】

python actual combat

【pygame Development practice development 30 example Complete source code 】

【pygame Game development column , Get the full source code + course 】

CSDN Official learning recommendation ↓ ↓ ↓

  • CSDN Out of Python Full stack knowledge map , too strong , I recommend it to you ！

原网站

版权声明
本文为[LexSaints]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/02/202202140003345211.html

边栏推荐

猜你喜欢

随机推荐