Read files through directory traversal

Needs: Untrusted path reaches a filesystem read outside its intended directory; process identity can read the requested file

Linux proof

# Linux proof
curl -skG --data-urlencode 'file=../../../../../../etc/passwd' http://TARGET:PORT/PATH

# Windows proof
curl -skG --data-urlencode 'file=../../../../../../Windows/System32/drivers/etc/hosts' http://TARGET:PORT/PATH

# Variant — traversal occurs in the URL path
curl -sk --path-as-is 'http://TARGET:PORT/static/../../../../etc/passwd'

Decisive output: recognizable contents of the requested target file. 200 OK, a changed template or a filename reflected in an error is not proof.

--path-as-is prevents curl from collapsing .. before sending the request.

Basic normalization/filter tests

# Variant — basic normalization/filter tests
..%2f..%2f..%2fetc%2fpasswd
%2e%2e/%2e%2e/%2e%2e/etc/passwd
....//....//....//etc/passwd

Next: use discovered user homes, application paths and configuration names to retrieve relevant source, keys or credentials. Send recovered authentication material to Block 5 with its source and identity context.

Try these only after a plain baseline. Preserve the exact decoding layer that accepted the value.

Next: use discovered user homes, application paths and configuration names to retrieve relevant source, keys or credentials. Send recovered authentication material to Block 5 with its source and identity context.

Verify → Require recognizable target-file content and controls that exclude a reflected input or static error page.

If it fails → An empty/denied response can be path depth, normalization or file permissions. If only file read is proven, follow credentials instead of assuming code execution. More detail ↓

If → then

A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol
A PHP page/include parameter and possible access to local application files → Disclose PHP source through an inclusion wrapper
Needs: A PHP inclusion sink accepts the filter wrapper and the process can read the source
JavaScript endpoints, backup names, exposed configuration or Git metadata → Inspect source, backups, configuration and repository artifacts
Needs: Readable application artifact or a complete recoverable repository; preserve the public-source scope

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Read files through directory traversal

USE WHEN: A download/path parameter or URL segment influences a local filename
STARTING ACCESS: A reproducible application request and a controlled input or access-context comparison
RESULT: A verified file-read primitive and relevant source/configuration/credential artifacts

Recognize the clue

Find real download/preview/export requests in the behavior map; inspect which filename/path values the normal request accepts.

curl -sk -b cookies.txt -D - 'http://TARGET:PORT/download?file=report.pdf'

SYNTHETIC EXAMPLE OUTPUT

GET /download?file=report.pdf
Content-Disposition: attachment; filename=report.pdf
Body: EXPECTED_REPORT_BYTES

Means: An application-controlled file selection is the cue to test path confinement; it is not yet arbitrary read.

Confirm: Request a known target-platform file through the real file parameter/path and compare with the normal response. Require recognizable file contents; a reflected filename, error or status change is not a read.

After validation: A controlled out-of-directory request returns the intended target bytes: the traversal method is available.
Ruled out in this context: An allowlist rejects paths and only serves approved report IDs: this path-selection context is not a traversal route.
Still inconclusive: An error mentioning a path shows influence but not read access; compare normal/control requests and permission/path depth.

Troubleshooting: An empty/denied response can be path depth, normalization or file permissions. If only file read is proven, follow credentials instead of assuming code execution.

Additional prerequisite checks

curl -skG --data-urlencode 'file=../../../../../../etc/passwd' http://TARGET:PORT/PATH

Linux proof:

Windows proof:

Decisive output: recognizable contents of the requested target file. 200 OK, a changed template or a filename reflected in an error is not proof.

Variant — traversal occurs in the URL path

--path-as-is prevents curl from collapsing .. before sending the request.

Variant — basic normalization/filter tests

Try these only after a plain baseline. Preserve the exact decoding layer that accepted the value.

Next: use discovered user homes, application paths and configuration names to retrieve relevant source, keys or credentials. Send recovered authentication material to Block 5 with its source and identity context.

Why it works

Traversal changes path resolution. URL decoding, application normalization and curl path normalization are separate layers; readable bytes do not establish interpreted inclusion.

Worked example · hypothetical

Observation: a download function accepts a filename. Test: request a recognizable system file with one controlled traversal. Illustrative output: expected account-file content. Interpretation: file read is confirmed; investigate relevant application configuration.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗