CHANGELOG
=========

This file contains the history of the changes made to DotDotPwn since
it's conception.
----------------
DotDotPwn v3.0.2
Release date: 09/Nov/2016

Changes / Enhancements / Features:
* Several new and improved fuzz patterns
* Added more traversal prefix and suffixes
* Fixed reports folder bug
* Fixed mistaken server outage detection
* Fixed whitespace and typo issues
* Bisection module fixes
* Documentation updates
* More os specific file variants
* Removed Switch dependency
* Only require TFTP module if fuzzing TFTP

----------------
DotDotPwn v3.0.1
Release date: 02/Apr/2013

Changes / Enhancements / Features:
* HTTP::Lite dependancy removed (Replaced with LWP core modules)
* -C switch to continue fuzzing (Instead of die()'ing)
* -S switch enables SSL for the http module
* http-url module supports SSL via https:// url
* More dot encodings to bypass string replace and blacklist filters

----------------
DotDotPwn v3.0
Release date: 03/Feb/2012 (Release at BugCon Security Conferences 2012)

Changes / Enhancements / Features:
* -X switch that implements the Bisection Algorithm in order to detect
  the exact deepness once a directory traversal vulnerability has been
  found.
  http://en.wikipedia.org/wiki/Bisection_method
* -M switch to specify another method different from the default (GET)
  when the http module is used.
  Other HTTP methods are [POST | HEAD | COPY | MOVE]
* -e switch to specify the file extension to be appended at the end of 
  each fuzz string (e.g. ".php", ".jpg", ".inc")
* New dots & slashes encodings (fuzz patterns) based on:
  https://www.owasp.org/index.php/Canonicalization,_locale_and_Unicode
  http://wikisecure.net/security/uri-encoding-to-bypass-idsips

Supported modules:
- HTTP
- HTTP URL
- FTP
- TFTP
- Payload (Protocol independent)
- STDOUT


----------------
DotDotPwn v3.0beta
Release date: 03/Aug/2011 (Black Hat USA 2011 (Arsenal) - Conference CD)
Demo: 21/Jul/2011 (Campus Party Mexico 2011)

Changes / Enhancements / Features:

* Random User-Agent in HTTP requests for IDS/IPS detection avoidance
  (previously it used to send "User-Agent: DotDotPwn v2.1")
* -o switch to specify the Operating System type if known
  ("windows" or "unix", or "generic" to include both of them)
* -E switch to include the files in user-defined @Extra_files array
  (config.inc.php, web.config, etc.)
* -r switch to save the results into the specified file
  (by default, it saves a report into the 'Reports' folder)
* Treatment of SIGINT in order to print the number of traversals found when 
  Ctrl + C is pressed.
* New dots encodings (fuzz patterns)
* Some functionality bugs were corrected 

Supported modules:
- HTTP
- HTTP URL
- FTP
- TFTP
- Payload (Protocol independent)
- STDOUT


----------------
DotDotPwn v2.1
Release date: 29/Oct/2010 (PUBLIC Release at BugCon Security Conferences 2010)
Release date: 14/Oct/2010 (NON-PUBLIC Version)

Changes / Enhancements / Features:

* STDOUT module implemented to be used as you wish (Read the EXAMPLES.txt to 
  see some examples)
* TFTP Module implemented
* -k switch for false positive avoidance making another verification once the
  HTTP Status 200 is received. This option looks for the specified parameter
  in the server's response.
  (e.g. -k "root:" if trying with /etc/passwd file
  or -k "localhost" in windows/system32/drivers/etc/hosts)
  With this option enabled, the HTTP module will print the total of false 
  positives detected during the scan as long as there is more than one.
* -p switch for payload specification.
  This option simply takes the text file passed as a parameter, replaces the
  'TRAVERSAL' tokens and sends it to the target (-h switch) in the specified
  port (-x switch)
  (e.g. a file called request.txt that contains an HTTP request including
  cookies, session ids, variables, etc. and the 'TRAVERSAL' tokens within the
  request that would be fuzzed)
* For the impatient, when it's working in quiet mode (-q switch), it prints
  dots each certain number of attempts to inform that it's still working ;).
* Prints the number of vulnerabilities found before exiting when an error 
  ocurrs (e.g. the Web server doesn't respond anymore because it has reached
  the maximum number of clients/sockets/threads)
* Prints the time taken at the end of the testing
* A cleaner usage message (help message)

Supported modules:
- HTTP
- HTTP URL
- FTP
- TFTP
- Payload (Protocol independent)
- STDOUT


----------------
DotDotPwn v2.0
Release date: 2/Sept/2010 (NON-PUBLIC Version)

Changes / Enhancements / Features:

* From Checker to Fuzzer
* Rewritten from the scratch
* Modular architechture (DotDotPwn packages)
* Traversal Engine to automatically create the fuzzing patterns to be sent.
  This engine makes all the combinations between the dots and slashes
  encodings, iterates the number of deepness passed as argument and finally,
  it concatenates the filenames intelligently according to the Operating System 
  detected (in case of -O switch enabled), otherwise, the engine includes all 
  the defined file sets (Windows, UNIX and Generic).
* -O switch for Operating System (nmap)
* -s switch for service detection
* -d switch to specify the desired deepness of traversals
  (e.g. deepness 3 equals to ../../../)
* -f switch available to define a specific file name to retrive
* -U and -P switches to supply specific usernames/passwords
* -t switch to specify the time in milliseconds between each attemp
* -x switch to specify a different TCP/UDP port than the defaults
* -b switch to break after the first vulnerability is found 
* -q switch for quiet mode (doesn't print each attemp in STDOUT)
* Special treatment of Slash/Backslash in filenames in order to have a 
  correct semantic within each traversal string.
* Improvement in the FTP module to compare against the server's response code
  instead of vendor-dependent response message (compliance with RFC 959 FTP)
* Improvement in the parameter passing
* A cool banner was included ;)

Supported modules:
- HTTP
- HTTP URL
- FTP


---------------
DotDotPwn v1.0
Release date: 21/Aug/2010

Features:
* Traversal database (external .txt files) holds 881 attack payloads
* -update flag available to perform an online database update
* Only checks the presence of boot.ini on Windows based HTTP/FTP servers
* Based on Shlomi Narkolayev.s Directory Traversal Cheat Sheet
  http://narkolayev-shlomi.blogspot.com/2010/04/directory-traversal-fuzz-list.html


Supported modules:
- HTTP
- FTP
