What is Directory Traversal?

Directory traversal is a vulnerability that allows attackers to access files and directories outside the intended web root by manipulating file path references in requests.

What is directory traversal?

Directory traversal, also called path traversal, is a vulnerability that allows attackers to read arbitrary files on the server by manipulating file path parameters. By injecting sequences like dot-dot-slash into file references, attackers escape the intended directory and access sensitive system files, configuration files, source code, and credentials stored elsewhere on the server.

How do directory traversal attacks work?

Attackers modify file path parameters in HTTP requests by inserting relative path sequences to navigate the file system hierarchy. For example, changing a filename parameter to include multiple parent directory references can reach system files like /etc/passwd on Linux or boot.ini on Windows. Variations include URL encoding, double encoding, and null byte injection to bypass filters.

What is the difference between directory traversal and local file inclusion?

Directory traversal reads file contents for information disclosure while local file inclusion loads and executes files within the application context. LFI can achieve remote code execution when combined with techniques like log poisoning or file upload. Both exploit insufficient path validation, but LFI has significantly higher impact due to the potential for code execution.

What sensitive files can attackers access through directory traversal?

Attackers target configuration files containing database credentials, application source code revealing business logic, environment files with API keys, SSH private keys, password hashes from system files, and web server configuration files. Access to these files often enables further attacks including credential theft, privilege escalation, and full system compromise.

How does ioSENTRIX test for directory traversal?

ioSENTRIX manually tests all file-handling parameters for traversal vulnerabilities using various encoding techniques and bypass methods. Our testers probe for both standard and blind traversal across URL parameters, HTTP headers, cookies, and multipart form data. Manual testing identifies traversal vectors that automated scanners miss due to encoding variations and application-specific filter bypasses.

How can developers prevent directory traversal?

The most effective prevention is avoiding the use of user input in file path operations entirely. When necessary, use allowlists of permitted filenames, canonicalize paths before validation, implement chroot jails or containerization, and validate that resolved paths remain within the intended directory. Never rely solely on blacklisting traversal sequences as bypass techniques are numerous.

What is a null byte injection in directory traversal?

Null byte injection appends a null character to truncate file paths in languages like PHP and older Java versions. This technique bypasses file extension validation by terminating the string before the enforced extension is appended. While modern language versions have largely fixed null byte handling, legacy applications remain vulnerable to this classic bypass technique.

Can directory traversal lead to remote code execution?

Directory traversal can escalate to remote code execution through several attack chains. Reading source code may reveal additional vulnerabilities. Accessing configuration files provides credentials for further exploitation. When combined with file upload functionality or log poisoning techniques for local file inclusion, directory traversal serves as the initial step toward complete server compromise.