dotdotpwn包装说明
这是一个非常灵活的智能模糊器来发现软件如HTTP / FTP / TFTP服务器，Web等平台的CMS，企业资源规划，博客等目录遍历漏洞 此外，它具有一个独立于协议的模块到所需的有效载荷发送到指定的主机和端口。另一方面，它也可以在使用STDOUT模块的脚本方式使用。 这是写在Perl编程语言，无论是在* NIX或Windows平台都可以运行。这包括在BackTrack的Linux操作系统（BT4 R2）的第一个墨西哥的工具。 模糊测试模块支持在这个版本：
- HTTP
- HTTP URL
- FTP
- TFTP
- 有效载荷（协议独立）
- STDOUT 资料来源：https://github.com/wireghoul/dotdotpwn
- 作者：chr1x，nitr0us
- 许可：GPL第二版
0x01 包含在dotdotpwn包工具
dotdotpwn.pl - DotDotPwn - 目录遍历的Fuzzer:~# dotdotpwn.pl ################################################################################# # # # CubilFelino Chatsubo # # Security Research Lab and [(in)Security Dark] Labs # # chr1x.sectester.net chatsubo-labs.blogspot.com # # # # pr0udly present: # # # # ________ __ ________ __ __________ # # \______ \ ____ _/ |_\______ \ ____ _/ |_\______ \__ _ __ ____ # # | | \ / _ \\ __\| | \ / _ \\ __\| ___/\ \/ \/ // \ # # | ` \( <_> )| | | ` \( <_> )| | | | \ /| | \ # # /_______ / \____/ |__| /_______ / \____/ |__| |____| \/\_/ |___| / # # \/ \/ \/ # # - DotDotPwn v3.0 - # # The Directory Traversal Fuzzer # # http://dotdotpwn.sectester.net # # # # # # by chr1x & nitr0us # ################################################################################# Usage: ./dotdotpwn.pl -m <module> -h <host> [OPTIONS] Available options: -m Module [http | http-url | ftp | tftp | payload | stdout] -h Hostname -O Operating System detection for intelligent fuzzing (nmap) -o Operating System type if known ("windows", "unix" or "generic") -s Service version detection (banner grabber) -d Depth of traversals (e.g. deepness 3 equals to ../../../; default: 6) -f Specific filename (e.g. /etc/motd; default: according to OS detected, defaults in TraversalEngine.pm) -E Add @Extra_files in TraversalEngine.pm (e.g. web.config, httpd.conf, etc.) -S Use SSL - for HTTP and Payload module (use https:// for in url for http-uri) -u URL with the part to be fuzzed marked as TRAVERSAL (e.g. http://foo:8080/id.php?x=TRAVERSAL&y=31337) -k Text pattern to match in the response (http-url & payload modules - e.g. "root:" if trying /etc/passwd) -p Filename with the payload to be sent and the part to be fuzzed marked with the TRAVERSAL keyword -x Port to connect (default: HTTP=80; FTP=21; TFTP=69) -t Time in milliseconds between each test (default: 300 (.3 second)) -X Use the Bisection Algorithm to detect the exact deepness once a vulnerability has been found -e File extension appended at the end of each fuzz string (e.g. ".php", ".jpg", ".inc") -U Username (default: 'anonymous') -P Password (default: ') -M HTTP Method to use when using the 'http' module [GET | POST | HEAD | COPY | MOVE] (default: GET) -r Report filename (default: 'HOST_MM-DD-YYYY_HOUR-MIN.txt') -b Break after the first vulnerability is found -q Quiet mode (doesn't print each attempt) -C Continue if no data was received from host0x02 dotdotpwn用法示例
使用HTTP扫描模块 （-m HTTP） 对 主机（-h 192.168.1.1）， 使用GET方法 （GET -M）：
:~# dotdotpwn.pl -m http -h 192.168.1.1 -M GET
#################################################################################
# #
# CubilFelino Chatsubo #
# Security Research Lab and [(in)Security Dark] Labs #
# chr1x.sectester.net chatsubo-labs.blogspot.com #
# #
# pr0udly present: #
# #
# ________ __ ________ __ __________ #
# \______ \ ____ _/ |_\______ \ ____ _/ |_\______ \__ _ __ ____ #
# | | \ / _ \\ __\| | \ / _ \\ __\| ___/\ \/ \/ // \ #
# | ` \( <_> )| | | ` \( <_> )| | | | \ /| | \ #
# /_______ / \____/ |__| /_______ / \____/ |__| |____| \/\_/ |___| / #
# \/ \/ \/ #
# - DotDotPwn v3.0 - #
# The Directory Traversal Fuzzer #
# http://dotdotpwn.sectester.net #
#
#
# #
# by chr1x & nitr0us #
#################################################################################
[+] Report name: Reports/192.168.1.1_05-20-2014_08-41.txt
[========== TARGET INFORMATION ==========]
[+] Hostname: 192.168.1.1
[+] Protocol: http
[+] Port: 80
[=========== TRAVERSAL ENGINE ===========]
[+] Creating Traversal patterns (mix of dots and slashes)
[+] Multiplying 6 times the traversal patterns (-d switch)
[+] Creating the Special Traversal patterns
[+] Translating (back)slashes in the filenames
[+] Adapting the filenames according to the OS type detected (generic)
[+] Including Special sufixes
[+] Traversal Engine DONE ! - Total traversal tests created: 19680
[=========== TESTING RESULTS ============]
[+] Ready to launch 3.33 traversals per second
[+] Press Enter to start the testing (You can stop it pressing Ctrl + C)
原文来自https://www.hackfun.org/kali-tools/dotdotpwn_zh.html。转载请注明原出处，商用请联系原作者授权。