> For the complete documentation index, see [llms.txt](https://appsecexplained.gitbook.io/appsecexplained/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/file-inclusion/local-file-inclusion/directory-traversal.md).

# Directory traversal

## What is it?

Directory Traversal, also known as Path Traversal, is a vulnerability that allows an attacker to read files on the victim’s system by manipulating file paths used in the application. 

**A simple example:**

A vulnerable web application may have the endpoint /get\_file?path={filepath} When a request is made, the application returns the content of the specified file. If an attacker inserts a path into {filepath} such as ../../../etc/passwd, they might get access to the system files. The application then fetches this file, and if the file contents are sent in the response, the attacker can view sensitive system information.

Remember that a payload or attack may change depending on the application and the server's file system. Directory Traversal can often lead to: 

* Sensitive data exposure 
* System information disclosure

**Other learning resources:**

PortSwigger: <https://portswigger.net/web-security/file-path-traversal>&#x20;

## Checklist

* [ ] What is the technology stack you're attacking?&#x20;
* [ ] What application/framework is being used?&#x20;
* [ ] Is it PHP, Java, Python, .NET, etc?&#x20;
* [ ] Verify injection points&#x20;
  * [ ] URL parameters&#x20;
  * [ ] Form fields&#x20;
  * [ ] HTTP headers (e.g. cookies, etc)&#x20;
* [ ] Check if you can traverse to directories outside of the webroot:&#x20;
  * [ ] ../../../../etc/passwd&#x20;
  * [ ] ../../../../Windows/System32/config/SAM (Windows)&#x20;
* [ ] Is there a blocklist?&#x20;
* [ ] Is there a filter?&#x20;
* [ ] Is the filter recursive?&#x20;
* [ ] Is the filter on single characters or sets? (e.g. / vs ../)&#x20;
* [ ] Can you bypass the blocklist?&#x20;
* [ ] Is a specific extension required?&#x20;
* [ ] Can you read a sensitive file with allowed extensions?&#x20;
* [ ] Can you bypass with:&#x20;
  * [ ] Null byte? %00&#x20;
  * [ ] Encoding&#x20;
  * [ ] Double encoding&#x20;
  * [ ] URL encoding&#x20;
  * [ ] Unicode encoding&#x20;
* [ ] Test for log exposure&#x20;
* [ ] Can you read log files?&#x20;
* [ ] Other unexpected bypasses ../../ in the middle of the path

## Exploitation

Basic directory traversal

```
../../../../etc/passwd
```

Reading application's own configuration files

```
../../webapp/config/database.ini
```

Log exposure

```
../../../../var/log/apache2/access.log
```

Non-recursive filter bypass

```
..././..././..././..././..././..././etc/passwd
```

## Tools

{% embed url="<https://github.com/wireghoul/dotdotpwn>" %}