Detect and Exploit File Path Traversal Vulnerabilities

This skill covers file path traversal testing for authorized security assessments, defensive validation, or controlled educational environments only, as stated explicitly at the top: AUTHORIZED USE ONLY.

Its core workflow runs ten phases. Phase 1 explains path traversal fundamentals. Phase 2 identifies traversal points by examining parameters that commonly handle files. Phase 3 covers basic exploitation techniques: Linux traversal (../../../etc/passwd), Windows traversal, URL-encoded payloads, and direct absolute paths tested via curl. Phase 4 covers bypass techniques for when simple ../ stripping is in place: nested traversal sequences, mixed encoding, legacy null-byte injection, path truncation, double extensions, prefixing with the expected directory before traversing out, Unicode/overlong UTF-8 encoding, URL encoding variations, and Windows case variations.

Phases 5 and 6 catalog target files per OS: Linux (system files like /etc/passwd, SSH files, web server files, application configs, process information under /proc) and Windows (system files, IIS files, configuration files, user files). Phase 7 covers automated fuzzing for traversal (basic fuzzing, fuzzing with encoding variants, traversing to /etc/passwd, testing with custom headers/cookies). Phase 8 covers LFI-to-RCE escalation: injecting PHP code into logs (e.g. via SSH username or User-Agent header) and then including the poisoned log file, plus PHP wrapper exploitation (php://filter to read source as base64, php://input to execute POST data as PHP, data:// and expect:// wrappers for inline code/command execution).

Phase 9 defines a structured eight-step testing methodology: identify file-related parameters, test basic traversal, test encoding variations, test bypass techniques, test absolute paths, test legacy null-byte injection, attempt wrapper exploitation, and attempt log poisoning for RCE. Phase 10 (Prevention Measures) gives secure coding countermeasures: in PHP, using basename() to strip path components, validating against an explicit filename whitelist, or canonicalizing both the base directory and the user-supplied path via realpath() and verifying the resolved path still starts with the base; in Python, resolving both the base directory and the requested file via os.path.realpath() and rejecting access if the resolved path escapes the base directory.

Its quick reference catalogs common payloads (../../../etc/passwd, Windows win.ini traversal, filter-bypass sequences, absolute paths, PHP wrapper source-disclosure payloads), target files by OS and purpose (Linux /etc/passwd and /etc/shadow, Windows win.ini/boot.ini, wp-config.php for WordPress DB credentials), and encoding variants (URL encoding, double encoding, Unicode, null byte). Its constraints and limitations cover permission restrictions (files the application user can't access, shadow file requiring root), application restrictions (extension validation, base path validation, WAF blocking), and testing considerations (respect authorized scope, avoid accessing genuinely sensitive data, document all successful access). Its troubleshooting table covers no observable response difference, blocked payloads, and difficulty escalating to RCE.

// PHP: Canonicalize and verify base path
$base = "/var/www/files/";
$realBase = realpath($base);
$userPath = $base . $_GET['file'];
$realUserPath = realpath($userPath);

if ($realUserPath && strpos($realUserPath, $realBase) === 0) {
    include($realUserPath);
}

Use this skill only for authorized security assessments, defensive validation, or controlled educational environments - testing for and fixing path traversal and local file inclusion vulnerabilities within a defined, authorized scope.

Never use this skill to test systems without authorization; respect the authorized scope, avoid accessing genuinely sensitive data beyond what's needed to prove the vulnerability, and document all successful access.

Inputs: an authorized target application with file-handling parameters to test for path traversal / local file inclusion vulnerabilities.

Outputs: identified traversal points, proof-of-concept payloads and bypass techniques, LFI-to-RCE escalation findings where applicable, and secure coding fixes (whitelist validation, path canonicalization) to remediate the vulnerability.

curl, PHP wrappers (php://filter, php://input, data://, expect://), fuzzing tools referenced generically for automated traversal testing.

Security professionals conducting authorized path traversal / LFI testing and developers implementing secure file-access code to prevent it.