π Learn & Master Path Traversal
Comprehensive guide covering theory, bypass techniques, real-world examples, and prevention strategies
What is Path Traversal?
Path Traversal (also known as Directory Traversal) is a web security vulnerability that allows attackers to read arbitrary files on the server by manipulating file paths. Attackers use special character sequences like ../ to navigate up the directory structure and access sensitive files outside the web root.
How It Works
Path Traversal attacks exploit insufficient input validation when applications construct file paths based on user input. By using special character sequences like ../ (dot-dot-slash), attackers can navigate up the directory tree and access files outside the web root, including system files, configuration files, and application source code.
β VULNERABLE CODE
1// PHP - Unsafe file inclusion2$file = $_GET['page'];3include("/var/www/pages/" . $file);45// Attacker sends:6?page=../../../../etc/passwd78// Result: Reads /etc/passwdβ SECURE CODE
1// PHP - Secure file inclusion2$file = basename($_GET['page']);3$allowedFiles = ['home', 'about', 'contact'];45if (in_array($file, $allowedFiles)) {6 include("/var/www/pages/" . $file . ".php");7}Types of Path Traversal
Simple ../ sequences to navigate directories
Direct file access using full paths
URL/Unicode encoding to bypass filters
Complex patterns to defeat filters
What Can Happen?
- πSensitive File Disclosure:
Access to /etc/passwd, /etc/shadow, config files, .env files, SSH keys, database credentials
- π»Source Code Disclosure:
Reading application source code, revealing business logic, API keys, and additional vulnerabilities
- πCredential Theft:
Stealing database passwords, API keys, OAuth tokens, and other authentication credentials
- π₯Remote Code Execution:
In some cases, combining with log poisoning or file upload can lead to RCE
How to Prevent Path Traversal
- βInput Whitelisting: Input Whitelisting: Only allow predefined file names, never accept arbitrary paths
- βPath Normalization: Path Normalization: Use realpath() or similar to resolve paths and validate they're within allowed directories
- βAvoid User Input in Paths: Avoid User Input in Paths: Never use user input directly in file operations
- βFile Permissions: File Permissions: Implement strict file system permissions using principle of least privilege
- βChroot Jails: Chroot Jails: Use chroot or containerization to limit file system access
What is Path Traversal?
Path Traversal (also known as Directory Traversal) is a web security vulnerability that allows attackers to access files and directories outside of the intended directory. By manipulating file paths with sequences like ../, attackers can read sensitive files, access configuration data, and potentially achieve remote code execution.
How It Works
Path Traversal attacks exploit insufficient input validation when applications construct file paths based on user input. By using special character sequences like ../ (dot-dot-slash), attackers can navigate up the directory tree and access files outside the web root, including system files, configuration files, and application source code.
β VULNERABLE CODE
// Vulnerable PHP code
<?php
$file = $_GET['file'];
$content = file_get_contents("/var/www/files/" . $file);
echo $content;
?>
// Attacker payload:
// ?file=../../../../etc/passwd
// ?file=../../../var/www/html/.envβ SECURE CODE
// Secure PHP code
<?php
$allowed = ['doc1.txt', 'doc2.txt', 'readme.md'];
$file = $_GET['file'] ?? 'readme.md';
if (in_array($file, $allowed)) {
$content = file_get_contents("/var/www/files/" . $file);
echo $content;
} else {
die("Access denied");
}
?>Types of Path Traversal
π Basic Traversal
Simple ../ sequences to navigate directories
?file=../../../etc/passwdπ― Absolute Paths
Direct file access using full paths
?file=/etc/passwdπ Encoding Bypass
URL/Unicode encoding to bypass filters
?file=..%2f..%2fetc%2fpasswdπ Nested Bypass
Complex patterns to defeat filters
?file=....//....//etc/passwdWhat Can Happen?
- πSensitive File Disclosure:
Access to /etc/passwd, /etc/shadow, config files, .env files, SSH keys, database credentials
- π»Source Code Disclosure:
Reading application source code, revealing business logic, API keys, and additional vulnerabilities
- πCredential Theft:
Stealing database passwords, API keys, OAuth tokens, and other authentication credentials
- π₯Remote Code Execution:
In some cases, combining with log poisoning or file upload can lead to RCE
How to Prevent Path Traversal
- βInput Whitelisting: Only allow predefined file names, never accept arbitrary paths
- βPath Normalization: Use realpath() or similar to resolve paths and validate they're within allowed directories
- βAvoid User Input in Paths: Never use user input directly in file operations
- βFile Permissions: Implement strict file system permissions using principle of least privilege
- βChroot Jails: Use chroot or containerization to limit file system access