X-DOT
DotDotPwn
Perl-based fuzzer that automates directory-traversal and file-inclusion payload testing across HTTP, FTP, TFTP, and more.
OVERVIEW
DotDotPwn (github.com/wireghoul/dotdotpwn) is a Perl fuzzer dedicated to directory traversal / file inclusion: it generates a large matrix of '../' style payloads across traversal depths, OS-specific path separators, and encoding variations (URL, double URL, Unicode, and more), then fires them at a target through one of several protocol modules — http, http-url, ftp, tftp, payload (stdout), or a fuzzer for a specific file.
A -k/--keyword option makes it self-checking: point it at a string expected in a successfully traversed file (like 'root:' for /etc/passwd) and it flags which payload combinations actually returned that string, rather than requiring a tester to eyeball hundreds of responses.
USE CASES
Practical use cases
- 01
Fuzzing a file-path or filename parameter in a web app for classic and encoded directory-traversal sequences.
- 02
Testing FTP or TFTP services for path traversal outside their configured root directory.
- 03
Using the keyword-match option to auto-flag which payload variants successfully read a known target file (e.g., /etc/passwd, web.config).
- 04
Generating a reusable payload list (payload module) to feed into another tool like Burp Intruder for a more controlled manual pass.
QUICK START
Once a parameter or endpoint looks like it might read a file path, to fuzz traversal depth and encoding variations systematically instead of by hand.
- Confirm the target host, protocol, and parameter are inside the authorized scope, and that high-volume fuzzing traffic is acceptable.
- Install DotDotPwn's Perl dependencies (cpan or the distro packages listed in the README).
- Pick the module matching the target protocol (http, ftp, tftp, ...) and point it at the host.
- Add a -k keyword matching a file you expect to read successfully, so hits are flagged automatically instead of requiring manual review of every response.
- Review the flagged payloads, manually replay the successful ones, and record the exact traversal string used for the report.
perl dotdotpwn.pl -m http -h target.example.com -k "root:" -OBEFORE YOU RUN IT
What to check before running it
A full fuzzing run sends a very large number of requests (every depth × encoding combination); confirm the target and any WAF/rate limiting in front of it can absorb that volume before running it unattended.
A traversal that successfully reads a sensitive file (e.g., /etc/passwd, a config with credentials) is live data exposure the moment it succeeds — treat the output as sensitive and avoid re-running it more than necessary.
Keyword-based auto-detection can still miss encoded or partial responses; skim the raw traffic (or a proxy log) for near-misses the keyword check didn't catch.