# Directory Traversal and File Inclusion

> Read arbitrary files via path traversal, escalate file inclusion (LFI/RFI) to RCE, and turn insecure file uploads into web shells.

- **URL:** https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks
- **Certification:** [OSWA (WEB-200) Study Path](https://hackindex.io/learn/oswa-web-200-study-path.md)
- **Estimated study hours:** 2.5
- **Published:** 2026-09-26
- **Updated:** 2026-09-27

Directory traversal lets an attacker escape the intended directory and read arbitrary files on the server using sequences like `../`. Closely related is file inclusion, where a parameter that loads a file can be pointed at attacker-controlled content (local or remote), often escalating from file read to remote code execution. File upload flaws round out the group: a poorly validated upload plus a way to reach the uploaded file is a direct path to a web shell. Together these are among the most reliable footholds on the OSWA exam.

## Directory Traversal

Detection starts with parameters that look like they load files or paths, then testing relative and absolute traversal against OS-specific targets (`/etc/passwd` `win.ini`). When naive payloads are filtered, URL encoding, nested sequences, path prefix tricks, and null byte truncation bypass the filter. Reading configuration files and source often yields the credentials or logic needed for the next step.

## File Inclusion (LFI/RFI)

Local file inclusion reads files through an include parameter and, via PHP filter and stream wrappers, discloses source or achieves RCE through log poisoning, session injection, or <code>/proc/self/environ</code>. Remote file inclusion loads an attacker-hosted payload directly. Detection covers PHP and non-PHP stacks (Java/Spring, Node/Express, Python/Flask, .NET), and fuzzing accelerates finding the right path.

## File Upload

Upload testing establishes the baseline behavior, then bypasses validation: extension and double-extension tricks, content-type spoofing, magic-byte prefixes, null bytes, and polyglot files. Once a web shell lands, locating its path and confirming execution turns the upload into a reverse shell, including ASPX shells and `.htaccess`/`web.config` abuse on IIS.

## Study material

- [Directory Traversal Detection](https://hackindex.io/services/web/vulnerability-discovery/directory-traversal-detection.md) (read, core)
- [Directory Traversal](https://hackindex.io/services/web/exploitation/directory-traversal.md) (read, core)
- [File inclusion](https://hackindex.io/services/web/vulnerability-discovery/file-inclusion.md) (read, core)
- [HTTP File Inclusion Fuzzing](https://hackindex.io/services/web/vulnerability-discovery/file-inclusion/file-inclusion-fuzzing.md) (read, core)
- [Local File Inclusion Exploitation](https://hackindex.io/services/web/exploitation/file-inclusion/local-file-inclusion-exploitation.md) (read, core)
- [Remote File Inclusion Exploitation](https://hackindex.io/services/web/exploitation/file-inclusion/remote-file-inclusion-exploitation.md) (read, core)
- [LFI to Remote Code Execution](https://hackindex.io/services/web/exploitation/file-inclusion/lfi-to-remote-code-execution.md) (read, core)
- [File Upload Validation Testing](https://hackindex.io/services/web/vulnerability-discovery/file-inclusion/file-upload-testing.md) (read, core)
- [File Upload Exploitation](https://hackindex.io/services/web/exploitation/file-inclusion/file-upload-exploitation.md) (read, core)