{"id":1630,"date":"2020-06-29T15:41:44","date_gmt":"2020-06-29T13:41:44","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1630"},"modified":"2023-12-20T20:58:30","modified_gmt":"2023-12-20T19:58:30","slug":"blind-directory-enumeration","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1630","title":{"rendered":"Blind directory enumeration"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Try this ressources if you can access files, but not list\u00ading&nbsp;them.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>http:\/\/pwnwiki.io\/#!presence\/windows\/blind.md<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"http:\/\/awesomehackers.org\/2018\/05\/11\/path-traversal-cheat-sheet\/\">Cheat sheet&nbsp;1<\/a><\/li><li><a href=\"https:\/\/github.com\/swisskyrepo\/PayloadsAllTheThings\/tree\/master\/Directory%20Traversal\">List<\/a><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In Apache and prob\u00ada\u00adbly more sys\u00adtems you can <strong>\u201ctrav\u00adel over\u201d non-exist\u00ading files<\/strong> because the path is short\u00adened before check\u00ading the exis\u00adtence of a file. Exam\u00adple: \/test\/test.txt\/..\/..\/index.html will return in an Apache the root\u2019s index.html even if the test direco\u00adry and test file does\u00adn\u2019t&nbsp;exist.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Try this ressources if you can access files, but not list\u00ading&nbsp;them. http:\/\/pwnwiki.io\/#!presence\/windows\/blind.md Cheat sheet&nbsp;1 List In Apache and prob\u00ada\u00adbly more sys\u00adtems you can \u201ctrav\u00adel over\u201d non-exist\u00ading files because the path is short\u00adened before check\u00ading the exis\u00adtence of a file. Exam\u00adple: \/test\/test.txt\/..\/..\/index.html will return in an Apache the root\u2019s index.html even if the test direco\u00adry&nbsp;and&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[470,471],"tags":[278,277,50],"class_list":["post-1630","post","type-post","status-publish","format-standard","hentry","category-active-enum","category-privesc","tag-blind-enumeration","tag-directory-enumeration","tag-enumeration"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1630","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1630"}],"version-history":[{"count":3,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1630\/revisions"}],"predecessor-version":[{"id":3181,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1630\/revisions\/3181"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1630"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1630"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1630"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}