Home/ Questions/Q 3939858
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-20T00:20:57+00:00

I have been given a task of reproducing the issue/testing the unauthorized access to

  • 0

I have been given a task of reproducing the issue/testing the unauthorized access to file system through request.param and query string.

For instance i have something like this. request.querystring(“blah”);
How could somebody pass “../../../b1/b2” in the query string and access file system.

This may be related to cross site scripting.

Need help..at least provide resources. Thanks in advance.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Wish I could provide a definitive answer, but can at least steer you in some direction. Not sure how confident you are that request.querystring() was indeed responsible, but some possibilities are:

    Directory Traversal/Path Traversal:

    Overview: http://en.wikipedia.org/wiki/Directory_traversal
    Testing For: http://www.owasp.org/index.php/Testing_for_Path_Traversal

    Remote File Inclusion:

    Overview: http://en.wikipedia.org/wiki/Remote_file_inclusion
    Tutorial: http://www.offensivecomputing.net/?q=node/624 (KnightLighter’s Tutorial)

    Hope this moves you in the right direction.

    • 0