3 Directory traversal

3 Directory traversal目录遍历攻击

In this section, we’ll explain what directory traversal is, describe how to carry out path traversal attacks and circumvent common obstacles, and spell out how to prevent path traversal vulnerabilities. 如何实施路径遍历攻击，规避常见障碍，以及如何防范路径遍历漏洞

一、What

What is directory traversal?

Directory traversal (also known as file path traversal) is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files. In some cases, an attacker might be able to write to arbitrary files on the server, allowing them to modify application data or behavior, and ultimately take full control of the server.
目录遍历(也称为文件路径遍历)是一个web安全漏洞，允许攻击者读取正在运行应用程序的服务器上的任意文件。这可能包括应用程序代码和数据、后端系统的凭据和敏感的操作系统文件。在某些情况下，攻击者可能会写入服务器上的任意文件，从而允许他们修改应用程序数据或行为，并最终完全控制服务器。

二、通过目录遍历读取任意文件

Reading arbitrary files via directory traversal

1. Consider a shopping application that displays images of items for sale. Images are loaded via some HTML like the following:
   <img src="/loadImage?filename=218.png">

2. The loadImage URL takes a filename parameter and returns the contents of the specified file. The image files themselves are stored on disk in the location /var/www/images/. To return an image, the application appends the requested filename to this base directory and uses a filesystem API to read the contents of the file. In the above case, the application reads from the following file path:
   loadImage URL使用filename参数，并返回指定文件的内容。 映像文件本身存储在磁盘上的/ var / www / images /位置。 为了返回图像，应用程序将请求的文件名附加到此基本目录，并使用文件系统API读取文件的内容。 在上述情况下，应用程序将从以下文件路径读取：/var/www/images/218.png

3. The application implements no defenses against directory traversal attacks, so an attacker can request the following URL to retrieve an arbitrary file from the server’s filesystem:应用程序没有实现针对目录遍历攻击的防御，因此攻击者可以请求以下URL从服务器的文件系统中检索任意文件https://insecure-website.com/loadImage?filename=../../../etc/passwd

4. This causes the application to read from the following file path:/var/www/images/../../../etc/passwd

5. The sequence ../ is valid within a file path, and means to step up one level in the directory structure. The three consecutive ../ sequences step up from /var/www/images/ to the filesystem root, and so the file that is actually read is:
   顺序../在文件路径中有效，表示在目录结构中上一级。 三个连续的../序列从/ var / www / images /升至文件系统根目录，因此实际读取的文件为：/etc/passwd

6. On Unix-based operating systems, this is a standard file containing details of the users that are registered on the server.在基于unix的操作系统上，这是一个标准文件，包含在服务器上注册的用户的详细信息