From the course: Vulnerability Management with Nessus

Unlock the full course today

Join today to access over 24,900 courses taught by industry experts.

Defending against directory traversal

Defending against directory traversal - Nessus Tutorial

From the course: Vulnerability Management with Nessus

Start my 1-month free trial Buy for my team

Defending against directory traversal

“

- [Instructor] Directory traversal attacks are another common web application security flaw. These attacks allow the attacker to manipulate the file system structure on the web server. Let's first talk about two important characteristics of file systems. When using a Linux file system, a single period references the current directory and using two periods references the directory one level up in the hierarchy. A directory traversal attack uses these navigation references to try to move up and down the directory structure, searching for unsecured files. These attacks work when an application allows a user to request files stored elsewhere on the file system. We're going to try one of these attacks using a tool called WebGoat. But first, here's a look at the file system that we'll be using in this exercise to help you understand what's happening in the demo. The ThreadSafetyProblem.html file is the one that we're actually supposed to get with the web application. The tomcat-users.xml…

Contents