Mastering Directory Traversal - The Ultimate Hands-On Course

Name: Mastering Directory Traversal - The Ultimate Hands-On Course
Rating: 4.6 (175 reviews)

How to Find, Exploit & Defend Against Directory Traversal Vulnerabilities. For Ethical Hackers, Developers & Pentesters.

Created byExperts with David Bombal, Rana Khalil, David Bombal

Last updated 10/2023

English

English [Auto],

What you'll learn

Learn how to find directory traversal vulnerabilities.
Learn how to exploit directory traversal vulnerabilities of varying difficulty levels.
Gain hands-on experience exploiting directory traversal vulnerabilities using Burp Suite Community and Professional editions.
Learn how to automate attacks in Python.
Learn secure coding practices to defend against directory traversal vulnerabilities.

Course content

6 sections • 17 lectures • 1h 47m total length

Course Introduction2:26
Master the directory traversal concepts through theory and six hands-on labs, from white-box and black-box testing to scripting exploits in Python, using Port Swingers Web Security Academy labs.

Answering your questions1:54
Join the unified Discord server to get quicker, cross-platform support and a centralized Q&A for this course and other platforms, with email or phone verification to authenticate.
Udemy tips and tricks3:20
Learn Udemy interface tips and tricks to optimize your study experience, from playback speed and captions to transcripts, resources, offline downloads, notes, keyboard shortcuts, and Q&A navigation.

Agenda0:49
What is Directory Traversal?8:18
How Do You Find Directory Traversal Vulnerabilities?6:08
How Do You Exploit Directory Traversal Vulnerabilities?3:39
Explore how to exploit directory traversal vulnerabilities, from using dot dot slash and absolute paths to bypass validation, encoding payloads, and using null bytes with scanners.
How Do You Prevent Directory Traversal Vulnerabilities?1:28
discover how to prevent directory traversal vulnerabilities by avoiding user input in file system calls, and applying a two-layer defense: input validation and path canonicalization against the target directory.
Additional Resources0:20

Lab #1 File path traversal, simple case13:54
In this video, we cover Lab #1 in the Directory Traversal Vulnerabilities module of the Web Security Academy. This lab contains a file path traversal vulnerability in the display of product images. The application validates that the supplied filename ends with the expected file extension.
Lab #2 File path traversal traversal sequences blocked with absolute path bypass10:50
In this video, we cover Lab #2 in the Directory Traversal Vulnerabilities module of the Web Security Academy. This lab contains a file path traversal vulnerability in the display of product images. The application blocks traversal sequences but treats the supplied filename as being relative to a default working directory.
Lab #3 File path traversal, traversal sequences stripped non-recursively14:21
In this video, we cover Lab #3 in the Directory Traversal Vulnerabilities module of the Web Security Academy. This lab contains a file path traversal vulnerability in the display of product images. The application strips path traversal sequences from the user-supplied filename before using it.
Lab #4 File path traversal, traversal sequences stripped with superfluous URL-de12:14
In this video, we cover Lab #4 in the Directory Traversal Vulnerabilities module of the Web Security Academy. This lab contains a file path traversal vulnerability in the display of product images. The application blocks input containing path traversal sequences. It then performs a URL-decode of the input before using it.
Lab #5 File path traversal, validation of start of path10:23
In this video, we cover Lab #5 in the Directory Traversal Vulnerabilities module of the Web Security Academy. This lab contains a file path traversal vulnerability in the display of product images. The application transmits the full file path via a request parameter, and validates that the supplied path starts with the expected folder.
Lab #6 File path traversal, validation of file extension with null byte bypass9:50
In this video, we cover Lab #6 in the Directory Traversal Vulnerabilities module of the Web Security Academy. This lab contains a file path traversal vulnerability in the display of product images. The application validates that the supplied filename ends with the expected file extension.

Requirements

Basic knowledge of computers (i.e. how to use the internet).
Basic knowledge of web fundamentals (HTTP requests, methods, cookies, status codes, etc.).
Latest version of Kali Linux VM (free download).
PortSwigger Web Security Academy account to access the labs (free registration).
Basic knowledge of Python Scripting.

Description

Directory Traversal (or also known as file path traversal) is a vulnerability that allows an attacker to read arbitrary files on the server that is running the application. This includes files that contain credentials, system configuration and application code. In some cases, not only could you read arbitrary files, but you could also write to arbitrary files which usually leads to a full system compromise. Therefore, mastering the ability to identify and exploit directory traversal vulnerabilities has become an essential and foundational skill.

In this course, we dive into the technical details behind directory traversal vulnerabilities, how to find these types of vulnerabilities from a black-box and white-box perspective and the different ways to exploit these types of vulnerabilities. We also cover prevention and mitigation techniques that you can use to prevent directory traversal vulnerabilities.

This is not your average course that just teaches you the basics. It's the perfect mix of theory and practice! The course contains 6 hands-on labs of varying difficulty levels that teach you how to first manually exploit the vulnerability and then how to script/automate your exploit in Python.

If you're a penetration tester, application security specialist, bug bounty hunter, software developer, ethical hacker, or just anyone interested in web application security, this course is for you!

Who this course is for:

Penetration testers that want to understand how to find and exploit directory traversal vulnerabilities.
Software developers that want to understand how to defend against directory traversal vulnerabilities.
Bug bounty hunters that want to understand how to find and exploit directory traversal vulnerabilities.
Individuals preparing for the Burp Suite Certified Practitioner (BSCP) exam.
Individuals preparing for the OSWE certification.

Mastering Directory Traversal - The Ultimate Hands-On Course

What you'll learn

Explore related topics

Course content

Introduction1 lecture • 2min

Getting help2 lectures • 5min

Directory Traversal - Technical Deep Dive6 lectures • 21min

Lab Environment Setup1 lecture • 7min

Hands-On Directory Traversal Labs6 lectures • 1hr 12min

Bonus Lecture1 lecture • 1min

Requirements

Description

Who this course is for: