Create 000~ROOT~000-exposed.bcheck

[r3nt0n]

BCheck Contributions

This Bcheck attempts to detect the exposure of 000~ROOT~000 file, which can be leveraged like a path traversal to access the entire filesystem.

• BCheck compiles and executes as expected
• BCheck contains appropriate metadata (name, version, author, description and appropriate tags)
• Only .bcheck files have been added or modified
• BCheck is in the appropriate folder
• PR contains single or limited number of BChecks (Multiple PRs are preferred)
• BCheck attempts to minimize false positives

[Hannah-PortSwigger]

Thank you for your submission!

We have some feedback points for consideration - please let us know what you think :)

[r3nt0n]

Thank you for the feedback! Sorry, I'm still getting used to Bchecks.

Yes, I can see what you mean about the unnecessarily repeated requests. I tend to scan specific requests instead of entire targets, so I was trying to make sure that it's checked both in the current path and at the root level. If I understood correctly, using given path, the only way to detect the issue at the root level would be to specifically scan a root-level request, right?

Ideally, the behavior I would like to achieve would be:

• Test the issue one time at the root level, no matter which path is being currently scanned
• Test the issue again on each path scanned

Is there any way to achieve this?

[Hannah-PortSwigger]

@r3nt0n That's ok, we're here to help!

If that's the behavior you are looking for, then just changing given request then to given path then without changing the rest of your logic should result in that behavior happening.

Please let us know when you've made this change :)

[r3nt0n]

Thank you!

Change made. I also included some enhancements, to ensure that the Bcheck always perform a GET request, regardless the method used in the original request, and to better handle cases where the path ends with / and when it doesn't. Let me know what you think, any feedback would be appreciated.

[Hannah-PortSwigger]

Thanks for making the changes, looks good! 👍