|
HTTP URL directory traversal/climbing |
|
|
|
| FAQ | |||
|
|
SummaryIt looks like an intruder is trying to read other files from your system (other than the ones you intended to share).
Details
A common bug with web servers is when a hacker specifies a URL that looks something like /../../../foo/bar.txt. The contents of the website are usually in a subdirectory. The series of "../.." go up the directory structure, then down to the desired file.
The reason this attack works is because the programmer doesn't double-check the URL to see if it is a valid file in the website.
False Positives
This alert triggers whenever a URL contains a series of ../... Bad links in web-pages on a website can sometimes cause this alert. In this case, it indicates a misconfiguration, rather than an intrusion.
Defense
First, check the URL parameter of the alert to see what the file was the intruder accessed. Then check to see if the intruder successfully accessed the file. If it was a sensitive file, and the attacker was successful, you will need to take appropriate action. For example, if the attacker successfully grabbed the password file, then you will need to change all the passwords.
You should also make sure that the web-server in question is the latest version with the latest security patches applied. Most of these attacks are against "imbedded" web-servers (i.e. web-servers included as part of other products) rather than real web-servers like Apache and IIS.
| more information |
|
| ||||||||||
| |||||
Version appeared: