Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

Posts tagged #path-traversal

3 posts

All topics Clear tag filter

Files, objects & APIs php://filter/convert.base64-encode

Path Traversal6 min read

LFI vs RFI: From File Disclosure to Remote Code Execution

File inclusion bugs come in two flavors. Local File Inclusion pulls a server-side file into execution — leaking source and secrets, and escalating to code execution through php://filter, log poisoning or /proc/self/environ. Remote File Inclusion pulls in an attacker-hosted URL and runs it outright. The dividing line is include() versus a read-only readfile(), and the fix is to keep user input away from both.

Files, objects & APIsOverview ../../../etc/passwd

Path Traversal3 min read

Path Traversal: How ../ Reads Files You Never Meant to Share

Path traversal lets an attacker climb out of an intended directory with dot-dot-slash sequences and read arbitrary files on the server. Here is how it works, the encodings that defeat naive filters, and the canonicalization fix that stops it.

Files, objects & APIs %252e%252e%252fetc/passwd

Path Traversal5 min read

Bypassing Path-Traversal Filters: Encoding, Double-Encoding and Null Bytes

A filter that decodes input and then blocks ../ is defeated by the first encoding it didn't anticipate. Here is how percent-encoding, double-encoding, overlong UTF-8, backslashes, nested sequences and null bytes walk straight past a blocklist, and why canonicalize-then-verify is the only fix that holds.