> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/web/web-attacks/directory-traversal.md).

# Directory Traversal

## Directory traversal vs. File inclusion

We can use *directory traversal vulnerabilities* to obtain the contents of a file outside of the web server's web root. 

*File inclusion* vulnerabilities allow us to "include" a file in the application's running code. This means we can use file inclusion vulnerabilities to **execute** local or remote files, while directory traversal only allows us to read the contents of a file. 

If we leverage a directory traversal vulnerability in a PHP web application and specify the file **admin.php**, the source code of the PHP file will be displayed. On the other hand, when dealing with a file inclusion vulnerability, the **admin.php** file will be executed instead.

## Suggestive parameters

The following parameters suggest the poosibility of a directory traversal attack:

```
?file=
?f=
/file/someFile

?location=
?l=
/location/someLocation

search=
s=
/search/someSearch

?data=
?d=
/data/someData

?download=
?d=
/download/someFileData
```

## Testing for directory traversal

### Testing on Linux

Example files to test for:

* `/etc/passwd`
* `/etc/hosts`
* `/home/<user>/.bash_history`&#x20;
* `/home/<user>/.ssh/id_rsa`
* The user flag, e.g. `/home/<user>/user.txt`
* Files under the [/proc file system](https://www.kernel.org/doc/html/latest/filesystems/proc.html) such as `/proc/self/cwd/app.py` for Flask services.&#x20;

Things to test:

* Try to add `../../../../../` or `..%2F..%2F..%2F..%2F..%2F`
* Specify a non-existing page such as `does_not_exist.xyz` to provoke an error message that gives us more information

### Testing on Windows

Example files to test for:

* `C:\Windows\win.ini`, i.e `/Windows/win.ini`
* `C:\Windows\System32\drivers\etc\hosts`, i.e. `/Windows/System32/drivers/etc/hosts`
* The user flag, e.g. `C:\Users\<Username>\Desktop\user.txt`

Things to test:

* Relative path, i.e. add `../../../../../` or `..%2F..%2F..%2F..%2F..%2F`
* Try to change `/` for `\` or `\\`
* Absolute path, i.e. use `C:\full\path\to\file.txt`&#x20;

## Resources

File Inclusion/Path traversal - HackTricks: <https://hacktricks.wiki/en/pentesting-web/file-inclusion/index.html>

Directory traversal attack - Wikipedia: <https://en.wikipedia.org/wiki/Directory_traversal_attack>

Path Traversal - OWASP: <https://owasp.org/www-community/attacks/Path_Traversal>