HTTP Path Traversal Exploit
Attack scenariohttp:exploitMITRE T1595.002
- Version
- 0.4
- Name
- crowdsecurity/http-path-traversal-probing
- Remediation
- Ban
Detect path traversal attempt
Install with a top-level collection
16 collections include itsudo cscli collections install crowdsecurity/aws-cloudfrontInstalls 2 parsers and 47 scenarios, via HTTP - Generic Protection.
View AWS CloudFront →Installation
sudo cscli scenarios install crowdsecurity/http-path-traversal-probingThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
# path traversal probingtype: leaky#debug: truename: crowdsecurity/http-path-traversal-probingdescription: "Detect path traversal attempt"filter: "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && any(File('http_path_traversal.txt'),{evt.Meta.http_path contains #})"data:- source_url: https://hub-data.crowdsec.net/web/path_traversal.txtdest_file: http_path_traversal.txttype: stringgroupby: "evt.Meta.source_ip"distinct: "evt.Meta.http_path"capacity: 3reprocess: trueleakspeed: 10sblackhole: 2mlabels:remediation: trueclassification:- attack.T1595.002behavior: "http:exploit"label: "HTTP Path Traversal Exploit"service: httpspoofable: 0confidence: 3
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
The http path traversal probing scenario aims at detecting, with very little false positive chances, path traversal probing attempts.
Path traversal attempts will be detected with the presence of specific path manipulation patterns in the URI or the GET parameter such as ../ , %2Fetc%2Fpasswd ...
⚠️ This scenario is not a WAF and this scenario does not aims at replacing a WAF.