tailieunhanh - Google hacking for penetration tester - part 12

Trong ví dụ này, truy vấn của chúng tôi mang đến cho chúng tôi đến một URL tương đối của / php / admin / tour. Nếu bạn nhìn kỹ vào URL, bạn sẽ nhận thấy một "admin" thư mục hai cấp độ thư mục trên vị trí hiện tại của chúng tôi. Nếu chúng ta click vào "cha mẹ thư mục" liên kết, chúng tôi sẽ được đưa lên một thư mục, vào thư mục "php". | Google Hacking Basics Chapter 3 111 In this example our query brings us to a relative URL of admin php tour. If you look closely at the URL you ll notice an admin directory two directory levels above our current location. If we were to click the parent directory link we would be taken up one directory to the php directory. Clicking the parent directory link from the envr directory would take us to the admin directory a potentially juicy is very basic directory traversal. We could explore each and every parent directory and each of the subdirectories looking for juicy stuff. Alternatively we could use a creative site search combined with an inurl search to locate a specific file or term inside a specific subdirectory such as site inurl admin for example. We could also explore this directory structure by modifying the URL in the address bar. Regardless of how we were to walk the directory tree we would be traversing outside the Google search wandering around on the target Web is basic traversal specifically directory traversal. Another simple example would be replacing the word admin with the word student or public. Another more serious traversal technique could allow an attacker to take advantage of software flaws to traverse to directories outside the Web server directory tree. For example if a Web server is installed in the var www directory and public Web documents are placed in var www htdocs by default any user attaching to the Web server s toplevel directory is really viewing files located in var www htdocs. Under normal circumstances the Web server will not allow Web users to view files above the var www htdocs directory. Now let s say a poorly coded third-party software product is installed on the server that accepts directory names as arguments. A normal URL used by this product might be page URL would instruct the program to fetch the file located at var