Web SecurityHighDirectory traversal../ attack

Path Traversal

Manipulated file paths escape the intended directory to read or write arbitrary files.

Live Playground · Powered by this research

Path Traversal Checker

Enter a file path with traversal sequences to see what it resolves to.

Traversal sequences (../)2

Encoded traversalNo

Decoded path../../etc/passwd

Normalized path/etc/passwd

Path escapes intended directory. Server must reject this input.

Payloads from this research (7 total)

../../../../etc/passwd

..%2F..%2F..%2Fetc%2Fpasswd

..%252F..%252F..%252Fetc%252Fpasswd

%%32%65%%32%65/etc/passwd

These payloads were synthesized from real HackerOne disclosures. Click any payload to copy it, then paste it into the tester above to see how our detection classifies it.

Overview

When a filename/path from input is used without canonicalization, sequences like ../ or encoded variants reach files outside the web root, including secrets and source code.

How it works

When a filename/path from input is used without canonicalization, sequences like ../ or encoded variants reach files outside the web root, including secrets and source code.

Example

http

GET /download?file=../../../../etc/passwd

Impact

Disclosure of source, config, and credential files; with write access, code execution.

Detection

Probe file/path params with traversal and encoded payloads and detect known file signatures in responses.

Prevention

Canonicalize and verify the resolved path stays within an allowed base directory.
Map user input to identifiers, not raw paths.
Run with least filesystem privilege.