module

Total.js prior to 3.2.4 Directory Traversal

Try Surface Command
Back to search
Disclosed
2019-02-18
Created
2019-03-19

Description

This module check and exploits a directory traversal vulnerability in Total.js prior to 3.2.4.

Here is a list of accepted extensions: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml,
woff, woff2, otf, ttf, eot, svg, zip, rar, pdf, docx, xlsx, doc, xls, html, htm, appcache,
manifest, map, ogv, ogg, mp4, mp3, webp, webm, swf, package, json, md, m4v, jsx, heif, heic

Authors

Riccardo Krauter
Fabio Cogno

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use auxiliary/scanner/http/totaljs_traversal
    msf auxiliary(totaljs_traversal) > show actions
        ...actions...
    msf auxiliary(totaljs_traversal) > set ACTION < action-name >
    msf auxiliary(totaljs_traversal) > show options
        ...show and set options...
    msf auxiliary(totaljs_traversal) > run
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today