topic Re: How to search for DR string ../../../../ ?? in Splunk Search

How to search for DR string ../../../../ ??

ShinR — Fri, 13 Aug 2021 08:05:38 GMT

Hi everyone,

I just wanted to do a quick search in URLs requested in Splunk but cannot get the directory traversal string (../../../../ o similar) to stick - it gets stripped from the query. I've tried using quotes and it seems escaping shouldn't be necessary.

Any suggestions?

Thanks

Re: How to search for DR string ../../../../ ??

richgalloway — Fri, 13 Aug 2021 12:30:01 GMT

Please share the troublesome query.

Re: How to search for DR string ../../../../ ??

ShinR — Fri, 13 Aug 2021 14:55:11 GMT

Sorry, here's a simple example:

index=* url="*../../../../*"

index=* "../../../../"

Re: How to search for DR string ../../../../ ??

richgalloway — Fri, 13 Aug 2021 23:34:53 GMT

I believe the problem is attempting to search for a string of minor blocker characters. You may have better luck using a separate where command.

index=foo ```Always use explicit index names``` | where like(url, "../../../../%") ```Like is used instead of match to avoid escaping every character```

Re: How to search for DR string ../../../../ ??

ShinR — Fri, 13 Aug 2021 16:48:27 GMT

Thanks again for the suggestion. Unfortunately everything between the * and the % gets stripped when I execute the search.

Re: How to search for DR string ../../../../ ??

richgalloway — Fri, 13 Aug 2021 23:35:47 GMT

The asterisk was a typo. Please try again without it.

Re: How to search for DR string ../../../../ ??

ShinR — Mon, 16 Aug 2021 08:37:38 GMT

Same result unfortunately... does the same thing not happen on your splunk instance?

Re: How to search for DR string ../../../../ ??

richgalloway — Mon, 16 Aug 2021 12:06:25 GMT

It does not happen on my instance (8.1.2)

Re: How to search for DR string ../../../../ ??

NatSec — Thu, 16 Dec 2021 13:00:48 GMT

I have the same issue on Splunk v8.2.1

Any solution please?