Friday 18 March 2016

Ebay INC (Magento) Web Security Bug Bounty: Directory Traversal / Local File Inclusion In

Little Insight: was vulnerable to a directory traversal / local file inclusion vulnerability. As a result, it was possible for an attacker to load web server-readable files from the local filesystem.


well this #LFI very interesting for me because when i am start my work i don't know its a java base application when i am go deep and deeper than i found its a java based application so this one very hard to find for me because  i am try to find as always etc/passwd 


Report Date :  27th may 2014 

Reward For  Directory Traversal Vulnerability  : 2500$


How This Work

when i was testing it was found url in sub-domain

after seen this url just try my luck for finding LFI so remove  de_DE-1988229788/4394/a32f094df7825f58c6a417309475c6c954804a27.10/1.0 and use url as
 but when i am use this its show you can't access this page

this time my mind sure its have insecure forward rule then now i am try for LFI still i am not know its java based application.

 ... now work begin....

My Finding....

In the above summary just got a click on my mind now i try to find etc/passwd using ../or ..//..// and many more try but not success 

between this i m find one more url that file contain some data

File contents found:
<web-app xmlns=""


here now i got my answer its a java application but i am a little surprise java application with insecure forward rule

than i start my work on google is it possible LFI in java application in a few hours i got something like


Web Application Directory Structure

now i try to find web.xml because  its an config file as on web apps on Apache php and other ../etc/pwd but here is java so its have web.xml file

so now url with ../web-inf/web.xml
after a few try i got this

and now i can access every file from dir on this server 


More about

The vulnerability mentioned here has been confirmed fixed by EBay Inc Team.

you can also meet me on 




  1. Are you looking to create your perfect piece of toast? Then take a look at some of our best toasters. Toaster ovens are their own special category separate from traditional slot toasters, and toaster reviews

  2. Chef's KnifeCutting boardCan OpenerMeasuring CupsMeasuring SpoonsMixing BowlsColanderVegetable Peeler .Kitchen Gadgets So Genius, You'll Wonder How You Ever Lived Without Them · True & Tidy 10-in-1 Smart Fruit Cutter Tools Set best kitchen tools·

  3. I just would like to give a huge thumbs up for the great info you have here on this post. Thanks for sharing with us. Are you looking for Escort Services in Ahmedabad and Call Girls in Ahmedabad
    Click For More Information Escorts Agency Ahmedabad