mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
20 lines
1.6 KiB
Markdown
20 lines
1.6 KiB
Markdown
# Client Side Path Traversal
|
|
|
|
{{#include ../banners/hacktricks-training.md}}
|
|
|
|
## Basic Information
|
|
|
|
A client side path traversal occurs when you can **manipulate the path of a URL** that is going to be **sent to a user to visit in a legit way** or that a user is somehow going to be **forced to visit for example via JS or CSS**.
|
|
|
|
- In [**this writeup**](https://erasec.be/blog/client-side-path-manipulation/), it was possible to **change the invite URL** so it would end up **canceling a card**.
|
|
- In [**this writeup**](https://mr-medi.github.io/research/2022/11/04/practical-client-side-path-traversal-attacks.html), it was possible to combine a **client side path traversal via CSS** (it was possible to change the path where a CSS resource was loaded from) with an **open redirect** to load the CSS resource from an **attacker controlled domain**.
|
|
- In [**this writeup**](https://blog.doyensec.com/2024/07/02/cspt2csrf.html), it's possible to see a tachnique on how to abuse CSPT **to perform a CSRF attack**. This is done by **monitoring all the data** that an attacker can control (URL path, parameters, fragment, adata injected in the DB...) **and the sinks** this data ends (requests being performed).
|
|
- Check [**this browser extension**](https://addons.mozilla.org/en-US/firefox/addon/eval-villain/) to monitor that.
|
|
- Check this [**CSPT playground**](https://github.com/doyensec/CSPTPlayground) to try the technique.
|
|
- Check [**this tutorial**](https://blog.doyensec.com/2024/12/03/cspt-with-eval-villain.html) on how to use the browser extension in the playground.
|
|
|
|
{{#include ../banners/hacktricks-training.md}}
|
|
|
|
|
|
|