DotDotPwn - The Directory Traversal Fuzzer.
It's a very flexible intelligent fuzzer to discover traversal directory vulnerabilities in software such as Web/FTP/TFTP servers, and Web platforms such as CMSs, ERPs, Blogs, etc. Also, it has a protocol-independent module to send the desired payload to the host and port specified. On the other hand, it also could be used in a scripting way using the STDOUT module. It's written in Perl programming language and can be run either under *NIX or Windows platforms.
Official Site: dotdotpwn
Download Link: **From Chatsubo (IN)Security Dark Labs Mirror **
Official E-mail: dotdotpwn@sectester.net
Last version:
DotDotPwn v2.1
Release date: 29/Oct/2010 (PUBLIC Release at BugCon Security Conferences 2010)
Release date: 14/Oct/2010 *NON-PUBLIC Version*
DEPRECATED HOW TO, CLICK HERE FOR THE LAST VERSION EBUILD ON PENTOO GITHUB
Preparing the portage tree, more info HERE:
evo ~ # mkdir -p /usr/local/portage/profiles/ evo ~ # echo "Headup Overlay" > /usr/local/portage/profiles/repo_name evo ~ # mkdir -p /usr/local/portage/net-analyzer/dotdotpwn/ evo ~ # echo "PORTDIR_OVERLAY=/usr/local/portage" >> /etc/make.conf evo ~ # cd /usr/local/portage/net-analyzer/dotdotpwn/ evo dotdotpwn # wget http://headup.sytes.net/zbox/pkfiles/dotdotpwn-2.1.ebuild evo dotdotpwn # ebuild dotdotpwn-2.1.ebuild manifest >>> Downloading 'http://www.brainoverflow.org/code/dotdotpwn-v2.1.tar.gz' --2011-09-27 13:51:42-- http://www.brainoverflow.org/code/dotdotpwn-v2.1.tar.gz Resolving www.brainoverflow.org (www.brainoverflow.org)... 75.125.156.234 Connecting to www.brainoverflow.org (www.brainoverflow.org)|75.125.156.234|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 27478 (27K) [application/x-gzip] Saving to: `/usr/portage/distfiles/dotdotpwn-v2.1.tar.gz' 100%[==================================================================>] 27,478 33.3K/s in 0.8s 2011-09-27 13:51:44 (33.3 KB/s) - `/usr/portage/distfiles/dotdotpwn-v2.1.tar.gz' saved [27478/27478] >>> Creating Manifest for /usr/local/portage/net-analyzer/dotdotpwn
Look the files
evo dotdotpwn # ll total 8 -rw-r--r-- 1 root root 398 Sep 27 13:51 Manifest -rw-r--r-- 1 root root 1478 Sep 27 13:51 dotdotpwn-2.1.ebuild
Searching in our portage tree and portdir overlay:
evo dotdotpwn # emerge dotdotpwn -s Searching... [ Results for search key : dotdotpwn ] [ Applications found : 1 ] * net-analyzer/dotdotpwn [ Masked ] Latest version available: 2.1 Latest version installed: [ Not Installed ] Size of files: 26 kB Homepage: http://dotdotpwn.blogspot.com Description: The Directory Traversal Fuzzer. License: GPL-3
Preparing and making our system consistent (good practice):
evo dotdotpwn # echo net-analyzer/dotdotpwn ~x86 >> /etc/portage/package.keywords evo dotdotpwn # echo net-analyzer/dotdotpwn os-detection >> /etc/portage/package.use evo dotdotpwn # echo perl-core/Switch ~x86 >> /etc/portage/package.keywords evo dotdotpwn # emerge dotdotpwn -pv These are the packages that would be merged, in order: Calculating dependencies... done! [ebuild N ~] perl-core/Switch-2.160.0 14 kB [0] [ebuild N ] net-analyzer/nmap-5.51 USE="ssl -gtk -lua" 16,474 kB [0] [ebuild N ] perl-core/Time-HiRes-1.97.19 86 kB [0] [ebuild N ] dev-perl/Log-Agent-0.307.0 54 kB [0] [ebuild N ] dev-perl/yaml-0.71 111 kB [0] [ebuild N ] app-portage/g-cpan-0.16.2 28 kB [0] [ebuild N ~] net-analyzer/dotdotpwn-2.1 USE="os-detection" 0 kB [1] Total: 7 packages (7 new), Size of downloads: 16,765 kB Portage tree and overlays: [0] /usr/portage [1] /usr/local/portage * IMPORTANT: 4 news items need reading for repository 'gentoo'. * Use eselect news to read news items.
And now, we are good to go.... merging....!!!!!!
evo dotdotpwn # emerge dotdotpwn ....... ....... ....... >>> Emerging (7 of 7) net-analyzer/dotdotpwn-2.1 from Headup-Overlay * dotdotpwn-v2.1.tar.gz RMD160 SHA1 SHA256 size ;-) ... [ ok ] ........ ........ If you don't have CPAN installed, you will see a lot of lines with CPAN and CPAN Modules installation.... Do not worry, just hit enter in every question.... ........ ........ >>> Unpacking source... ........ ........ >>> Install dotdotpwn-2.1 into /var/tmp/portage/net-analyzer/dotdotpwn-2.1/image/ category net-analyzer >>> Completed installing dotdotpwn-2.1 into /var/tmp/portage/net-analyzer/dotdotpwn-2.1/image/ >>> Installing (7 of 7) net-analyzer/dotdotpwn-2.1 ........ ........ >>> Recording net-analyzer/dotdotpwn in "world" favorites file. ........ ........ * Messages for package net-analyzer/dotdotpwn-2.1: * Package: net-analyzer/dotdotpwn-2.1 * Repository: Headup-Overlay * USE: elibc_glibc kernel_linux os-detection userland_GNU x86 * FEATURES: preserve-libs sandbox userpriv usersandbox * Package: net-analyzer/dotdotpwn-2.1 * Repository: Headup-Overlay * USE: elibc_glibc kernel_linux os-detection userland_GNU x86 * FEATURES: preserve-libs sandbox userpriv usersandbox * nothing to compile * Removing /usr/share/info >>> Auto-cleaning packages... >>> No outdated packages were found on your system. * IMPORTANT: 4 news items need reading for repository 'gentoo'. * Use eselect news to read news items.
And now everything is in place, libs and files.
evo dotdotpwn # cd evo ~ # ll /etc/dotdotpwn/ total 64 -rw-r--r-- 1 root root 606 Sep 27 14:09 AUTHORS.txt -rw-r--r-- 1 root root 3851 Sep 27 14:09 CHANGELOG.txt -rw-r--r-- 1 root root 6671 Sep 27 14:09 EXAMPLES.txt -rw-r--r-- 1 root root 35147 Sep 27 14:09 LICENSE.txt -rw-r--r-- 1 root root 2490 Sep 27 14:09 README.txt -rw-r--r-- 1 root root 2964 Sep 27 14:09 USAGE.txt -rw-r--r-- 1 root root 85 Sep 27 14:09 payload_sample.txt drwxr-xr-x 2 root root 48 Sep 27 14:09 retrieved_files evo ~ # ll /usr/bin/dotdotpwn* lrwxrwxrwx 1 root root 21 Sep 27 14:09 /usr/bin/dotdotpwn -> /usr/bin/dotdotpwn.pl -rwxr-xr-x 1 root root 9135 Sep 27 14:09 /usr/bin/dotdotpwn.pl evo ~ # ll `perl -e 'use strict; print map {"$INC{$_}"} keys %INC' | awk '{sub("strict.pm","") ; print }'`/DotDotPwn total 44 -rw-r--r-- 1 root root 2235 Sep 27 04:32 FTP.pm -rw-r--r-- 1 root root 796 Sep 27 04:32 File.pm -rw-r--r-- 1 root root 2134 Sep 27 04:32 Fingerprint.pm -rw-r--r-- 1 root root 1787 Sep 27 04:32 HTTP.pm -rw-r--r-- 1 root root 1739 Sep 27 04:32 HTTP_Url.pm -rw-r--r-- 1 root root 1818 Sep 27 04:32 Payload.pm -rw-r--r-- 1 root root 527 Sep 27 04:32 STDOUT.pm -rw-r--r-- 1 root root 2089 Sep 27 04:32 TFTP.pm -rw-r--r-- 1 root root 9681 Sep 27 04:32 TraversalEngine.pm
And finally.... have fun!!!!!
Thanks to @nitr0usmx and @chr1x for giving us dotdotpwn, and like they said... Happy fuzzing! ;)
