Path traversal (also known as directory traversal) is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files.
- File download functionality
- File upload functionality
- Template inclusion
- Image/document display features
- Static resource serving
Submit path traversal sequences (../, ...., etc.) in file parameters to attempt to access files outside the intended directory.
See path-traversal-payloads.txt for a comprehensive list of path traversal payloads.