Injection

Path Traversal

Apps that read files based on user-supplied filenames can be tricked into reading any file on the server. Learn how ../ sequences escape the intended directory.

Beginner45 min10 lessons3 hands-on

Start free →I have an account

First lesson free. The full module is part of Pro.

You'll be able to

✓Understand how directory traversal breaks out of the intended file root
✓Exploit path traversal to read /etc/passwd and application config files
✓Bypass filters using URL encoding, null bytes, and path normalisation
✓Escalate file read to RCE via log poisoning or SSH key disclosure

Lessons

1Citrix NetScaler — CVE-2019-19781: 80,000 Companies Exposed
2How Path Traversal Works
3Filter Bypass Techniques
4High-Value Files and Path Traversal to RCE
5Your Turn: Escape the DirectoryHANDS-ON
6Level Up: Encode Past the FilterHANDS-ON
7Tool — ffuf for Path Traversal Fuzzing
8Module quiz
9Prevention
10Hands-on Lab: Exploit FileVaultHANDS-ON

Start free →