An HTTP file server exposes a directory tree over HTTP for browsing and download, and often for upload. They range from a one-line built-in server (Python's http.server, PHP's built-in server) to purpose-built applications (HFS HTTP File Server, various NAS and appliance web UIs). The surface is consistent: directory listing that maps the served tree and reveals files, path traversal that escapes the served root to read arbitrary files, and upload functionality that becomes code execution when the uploaded file lands in a path the server serves or interprets.
# fingerprint the server and look for listing/upload
curl -sI http://<target>:<port>/ # Server header identifies the product
curl -s http://<target>:<port>/ # directory listing present?
curl -s -X OPTIONS http://<target>:<port>/ -i # methods (PUT => upload)
Subtopics#
- Directory listing: mapping the served tree.
- Path traversal: reading files outside the served root.
- File upload to RCE: turning upload into code execution.
- Known server exploits: product-specific file-server vulnerabilities.