wireghoul / dotdotpwn

DotDotPwn - The Directory Traversal Fuzzer

DESCRIPTION

DotDotPwn - The Directory Traversal Fuzzer

It's a very flexible intelligent fuzzer to discover traversal directory vulnerabilities in software such as HTTP/FTP/TFTP servers, Web platforms such as CMSs, ERPs, Blogs, etc.

Also, it has a protocol-independent module to send the desired payload to the host and port specified. On the other hand, it also could be used in a scripting way using the STDOUT module.

It's written in perl programming language and can be run either under OS X, *NIX or Windows platforms. It's the first Mexican tool included in BackTrack Linux (BT4 R2).

Fuzzing modules supported in this version:

• HTTP
• HTTP URL
• FTP
• TFTP
• Payload (Protocol independent)
• STDOUT

REQUIREMENTS

• Perl (http://www.perl.org) Programmed and tested on Perl 5.8.8 and 5.10

• Nmap (http://www.nmap.org) Only if you plan to use the OS detection feature (needs root privileges)

Perl modules:

• Net::FTP
• TFTP (only required if fuzzing TFTP)
• Time::HiRes
• Socket
• IO::Socket
• Getopt::Std

You can easily install the missing modules doing the following as root:

# perl -MCPAN -e "install <MODULE_NAME>"

or

# cpan 
cpan> install <MODULE_NAME>

EXAMPLES

Read EXAMPLES.txt

CONTACT

Official Website: http://dotdotpwn.sectester.net Official Email: [email protected] Bugs / Contributions / Improvements: [email protected]

AUTHORS

 Christian Navarrete aka chr1x         Alejandro Hernandez H. aka nitr0us
   http://twitter.com/chr1x              http://twitter.com/nitr0usmx
      [email protected]                  [email protected]
                                         http://www.brainoverflow.org

 CubilFelino Security Research Lab     Chatsubo [(in)Security Dark] Labs
   http://chr1x.sectester.net          http://chatsubo-labs.blogspot.com   

CHANGE HISTORY

Read CHANGELOG.txt

LICENSE

DotDotPwn - The Directory Traversal Fuzzer
Copyright (C) 2012 Christian Navarrete and Alejandro Hernandez H.

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>

dotdotpwn's Issues

vulnerable results 403 forbidden

Hi,

I've ran dotdotpwn v3.0.2 against a web application that has reported 304 traversals.

I ran the following command:

./dotdotpwn.pl -m http -h xxxxxxxx -S -k "root"

All of the vulnerable traversals have a "?" in them, not sure if that is relevant. An example is:

[*] Testing Path (response analysis): https://xxxxxxxxxxx:443/?.%25c0%25af?.%25c0%25af?.%25c0%25af?.%25c0%25af?.%25c0%25af?.%25c0%25afetc%25c0%25afissue <- VULNERABLE!

But when I enter that URL into Chrome it comes back as 403 forbidden.

If it helps the server is running nginx v1.11.3

Thanks for your help!

No Cookie Usage

Hey,
There's no flag to use cookies.. that makes that tool less useful from my presepection.
Would be nice to have one

No issue

Net::FTP is up to date (3.08).
TFTP is up to date (1).
Time::HiRes is up to date (1.9739).
Socket is up to date (2.021).
IO::Socket is up to date (1.31).
Getopt::Std is up to date (1.11).
Switch is up to date (2.17).

Basic auth for http?

How can I give a user:password@host combination for a host that requires basic auth? Alternatively, can I set a header to produce the same result?

Redirected URLs leads to false positive results.

The software outputs hundres of vulnerable urls but they are actually redirected to home page of the website, which is not vulnerable.

Error load scriptlib perl

after installed the perl module in mint distro

causes the error below

Can not locate TFTP.pm in @inc (you may need to install the TFTP module) (@inc contains:. / Etc / perl /usr/local/lib/perl/5.18.2 / usr / local / share / perl /5.18.2 / usr / lib / perl5 / usr / share / perl5 /usr/lib/perl/5.18 /usr/share/perl/5.18 / usr / local / lib / site_perl) at DotDotPwn / TFTP.pm line 13.

Solution
the line of code use TFTP;
you must place the following line because the module is in 'Net'
use Net ::TFTP; # / Usr / share / perl5 / Net / TFTP.pm

Make -k switch optional and use sane defaults for patterns

Currently the http-url and http modules are requiring a pattern passed via the -k parameter like -k "root:"

It would make sense to use sane defaults for each tested file like:

/etc/passwd -> root:
/etc/hosts -> localhost
boot.ini -> [boot loader]

and just make -k optional where people can overwrite the tested pattern.

Web Server (all-around-audit-solutions.com) Didn't Respond

Hello!

Could you please help me resolve the issue that I am having when trying to dotdotpwn my website? I downloaded the most recent version of dotdotpwn yesterday to my Kali Linux VM. I have been trying various commands, the latest being:
./dotdotpwn.pl -m http -h all-around-audit-solutions.com -M GET
The response that I keep receiving is:
Web server (all-around-audit-solutions.com) didn't respond !
Could this be because the website is hosted on a GoDaddy server?

Thank you very much for your time and best regards! BTW, I am impressed with your tool as I was able to run it against other domains.

Single deepness / deepness range

Hi,

for some scenarios it could be useful to set a single deepnes or a deepness range to the traversal pattern. For example if we know that the traversal is in this url:

http://example.com/foo/bar/foo/bar/foo.php?=TRAVERSAL

it doesn't make any sense when testing for /etc/passwd to traversal like:

http://example.com/foo/bar/foo/bar/foo.php?=../../etc/passwd

The minimum traversal deepnes should be 4 in this case which could speed up the testing a lot as the deepnes of 1 to 3 probably won't get any results. Any opinions to this?

can't find the Reports folder

Hi there,

i installed the latest version of dotdotpwn on my windows, and its modules including Net::FTP, TFTP, Time::Hires, Socket, IO::Socket, Getopt::Std, Switch. When I executed dotdotpwn.pl and pressed Ctrl+C to terminate the test, it tells me Report saved: Reports/TEST_URL_05-28-2016_09-13.txt.

Why can't i find the report folder?

Please help, thanks

System-wide install

While trying to install dotdotpwn in a docker image, I noticed the following at run time when executing dotdotpwn

Cannot open User-Agents.txt file: No such file or directory at /usr/lib/perl5/vendor_perl/DotDotPwn/HTTP_Url.pm 

dotdotpwn was installed that way

cp -r dotdotpwn-3.0.2/DotDotPwn/ /usr/lib/perl5/vendor_perl
cp dotdotpwn-3.0.2/dotdotpwn.pl /usr/bin/dotdotpwn

Libraries are found from /usr/lib/perl5/vendor_perl, no problem, but this specific resource (User-Agents.txt) cannot be found by HTTP_Url.pm even-though it is right next to it

bash-5.0# ls /usr/lib/perl5/vendor_perl/DotDotPwn/
BisectionAlgorithm.pm  File.pm                HTTP.pm                Payload.pm             TFTP.pm                User-Agents.txt
FTP.pm                 Fingerprint.pm         HTTP_Url.pm            STDOUT.pm              TraversalEngine.pm

I do not know how relative path is handled by pearl but I wondered if my current problem had anything to do with this specific line

dotdotpwn/DotDotPwn/HTTP_Url.pm

Line 32 in 98760e1

open(AGENTS, "DotDotPwn/User-Agents.txt") or die "[-] Cannot open User-Agents.txt file: $!";

It might sound naive but, from the standpoint of HTTP_Url.pm , isn't User-Agents.txt supposed to be at ./User-Agents.txt instead of DotDotPwn/User-Agents.txt?

I am a complete noob with pearl so I am open to any cleaner way to install this tool system wide

Web server didn't respond

Hi there! Great tool!

I try to run it by using:

$ ./dotdotpwn.pl -m http-url -u "http://amazon.de:80/TRAVERSAL" -o unix -k "root:" 
...
[+] Report name: Reports/amazon.de_08-27-2014_13-26.txt

[========== TARGET INFORMATION ==========]
[+] Hostname: amazon.de
[+] Setting Operating System type to "unix"
[+] Protocol: http
[+] Port: 80

[=========== TRAVERSAL ENGINE ===========]
[+] Creating Traversal patterns (mix of dots and slashes)
[+] Multiplying 6 times the traversal patterns (-d switch)
[+] Creating the Special Traversal patterns
[+] Translating (back)slashes in the filenames
[+] Adapting the filenames according to the OS type detected (unix)
[+] Including Special sufixes
[+] Traversal Engine DONE ! - Total traversal tests created: 10560

[=========== TESTING RESULTS ============]
[+] Ready to launch 3.33 traversals per second
[+] Press Enter to start the testing (You can stop it pressing Ctrl + C)

[+] Replacing "TRAVERSAL" with the traversals created and sending

[+] Fuzz testing finished after 0.02 minutes (1 seconds)
[+] Total Traversals found (so far): 0
[-] Web server didn't respond !

Web server didn't respond. But the host is obviously online. What am I doing wrong?

Thx in advance,

Victor

using case

what is the right way to combine multiple key words to search in the files, Is it like :

dotdotpwn -m http-url -u https://www.site/TRAVERSAL -k 'root:' 'secret' (space between words)

or

dotdotpwn -m http-url -u https://www.site/TRAVERSAL -k 'root:', 'secret' ( comma between words)

Update to newer perl

Hello, could you update to the Perl v5.14.2
i get this error

Can't locate TFTP.pm in @inc (@inc contains: . /etc/perl /usr/local/lib/perl/5.14.2 /usr/local/share/perl/5.14.2 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.14 /usr/share/perl/5.14 /usr/local/lib/site_perl) at DotDotPwn/TFTP.pm line 13.
BEGIN failed--compilation aborted at DotDotPwn/TFTP.pm line 13.
Compilation failed in require at DotDotPwn/BisectionAlgorithm.pm line 36.
BEGIN failed--compilation aborted at DotDotPwn/BisectionAlgorithm.pm line 36.
Compilation failed in require at DotDotPwn/HTTP.pm line 11.
BEGIN failed--compilation aborted at DotDotPwn/HTTP.pm line 11.
Compilation failed in require at ./dotdotpwn.pl line 59.
BEGIN failed--compilation aborted at ./dotdotpwn.pl line 59.

Changing port from default just shows 443

If I use -x $InsertPortNumberHere, in the banner before it runs it shows "Port: 443". When I omit the -x option, it then display the default port for the module selected. I've only tested this with the http module so far.

Typo in help banner

Hi,

there seems to be a typo in the help banner

(use https:// for in url for http-url)

https://github.com/wireghoul/dotdotpwn/blob/master/dotdotpwn.pl#L112

I don't know exactly what the sentence should be so just creating an issue and no pull request.

too slow

is there any option to increase the speed of the tool?
thanks in advance

https

Will there be HTTPS module in future? Now it is not supported.

Setting Authorization (or any other) Header

I would like to add an authorization header to requests in "http-url" module, maybe somewhat like with curl - curl -H "authorization: Bearer ...":

dotdotpwn -m http-url -u https://example.com/foo?bar=TRAVERSAL -k "root:" -H "authorization: Bearer ..."

Is this feature in place? If so, I guess it needs to be better documented, otherwise I suggest implementing such feature.

Fix directory separator in file variants

Ie, if / has to be encoded as %2f the traversal should use ..%2f..%2f..%2fetc%2fpasswd not ..%2f..%2f../etc/passwd

Ping reply as condition to continue the test

Hi! First of all, congratulations for the great App.

I would like to report a behavior I believe will help many users. In the HTTP_url.PM, the code dictates the app should terminate in case of a ping failure:

if(!$ping){
die "[-] Web server didn't respond !\n";

I was testing a windows box where firewall would not allow ping, and modifying the code allowed me to proceed with the test.

While by design, modifying the message to mention 'ping failure' as the cause would narrow down the issue for users.

Continue with your great projects! :)

Cookie support and custom headers?

Does this tool support adding custom cookies and request headers?