Nginx

Path traversal via misconfigured NGINX alias

Path traversal via misconfigured NGINX alias - Vulnerabilities - AcunetixAcunetix

https://example.com/static../ returns the same response as https://example.com/

NginxHackTricks

Burp extension

GitHub - bayotop/off-by-slash: Burp extension to detect alias traversal via NGINX misconfiguration at scale.GitHub

Tools

GitHub - hakaioffsec/navgix: navgix is a multi-threaded golang tool that will check for nginx alias traversal vulnerabilitiesGitHub

./navgix scan -u http://vulnerable.com/                                     
[navgix 2024-12-23_02:12:17.731403583] starting scan on http://vulnerable.com/
[navgix 2024-12-23_02:12:17.830559043] Vulnerable: http://vulnerable.com/assets../
[navgix 2024-12-23_02:12:17.926859226] Vulnerable: http://vulnerable.com/assets../

GitHub - shiblisec/Kyubi: A tool to discover and exploit Nginx alias traversal misconfiguration, the tool can bruteforce the URL path recursively to find out hidden files and directories.GitHub