navgix: check for nginx alias traversal vulnerabilities

by do son · October 25, 2023

navgix

navgix is a multi-threaded golang tool that will check for nginx alias traversal vulnerabilities.

Techniques

Currently, navgix supports 2 techniques for finding vulnerable directories (or location aliases). Those are the following:

Heuristics

navgix will make an initial GET request to the page, and if there are any directories specified on the page HTML (specified in src attributes on html components), it will test each folder in the path for the vulnerability, therefore if it finds a link to /static/img/photos/avatar.png, it will test /static/, /static/img/ and /static/img/photos/.

Brute-force

navgix will also test for a short list of common directories that are common to have this vulnerability and if any of these directories exist, it will also attempt to confirm if a vulnerability is present.