Directory Traversal
Directory traversal, also known as path traversal, allows an attacker to gain access to files within an application or system which normally should not be accessible through the web interface.
Identifying Directory Traversals
Look for references which appear to be referencing files. Some common places to look are URL query strings and in form bodies. A good indicator is that the original request has a file extension. For example, a URL query string may be ?file=myfile.php which suggests that the application is going to attempt to retrieve file.php from the server.
One way to test for this vulnerability is to add a random string where you believe the vulnerability is. If an error message is returned, it may indicate that it was not able to retrieve the requested file. This would be a good indicator that the application is vulnerable to this attack.
Verifying the Vulnerability
Once you have a likely candidate, attempt to read files that are readable by any user.
Last updated
Was this helpful?