Directory traversal¶

root-me challenge: Directory traversal: Find the hidden section of the photo galery.

Resources¶

• Directory traversal

• A Case of directory traversal

• BlackHat US 2011 DotDotPwn directory traversal fuzzer

• Etude de la faille CVE-2010-0013 Directory traversal vulnerability

Techniques¶

• Directory traversal

• Path traversal runbook

Counter moves¶

Directory traversal is the case here. Server-side validation and least privilege are what these reduce to. The defensive counterpart is in the blue notes on the application layer as a target.