Path Traversal
web · easy · +25 XP
// what is Path Traversal?
Path Traversal (LFI) = a file-fetch endpoint uses user input to build a filesystem path, and a weak sanitiser misses an escape. ../../etc/passwd, URL-encoded variants, double-encoded variants, null-byte tricks (PHP <5.3) — each one bypasses a different layer of defense. The fix is canonicalisation + allowlist, not blocklist.
// how attackers detect it
- [01]Try
../../../etc/passwd,..%2f..%2fetc%2fpasswd,....//....//etc/passwd. - [02]Look for filename params (
?file=,?page=,?template=,?include=). - [03]Run
ffuf -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txtagainst the param.
// how defenders prevent it
- ✓Canonicalise the path (
os.path.realpath) and assert it starts with the allowed base directory. - ✓Better: don't accept paths at all. Use a server-side ID-to-path map (
?file_id=42→ look up filename in DB). - ✓Run the web process as an unprivileged user that can't read
/etc/shadow, SSH keys, AWS creds.
// real-world incidents
CVE-2024-1709
ConnectWise ScreenWise path traversal
Auth bypass + path traversal chained for RCE on managed endpoints.
CVE-2021-41773
Apache 2.4.49 path traversal
Two days from disclosure to mass exploitation; mod_cgi → RCE.
// hands-on tips for this lab
- ›Filter rejects when name starts with
..or/. Put a safe prefix first →safe/../../etc/hc/flag.txt.
was this lesson helpful?
4 of 10 · web