Directory Traversal File Include

Check List

Methodology

Black Box

Directory Traversal (Local File Inclusion)

1

Identify endpoints serving static assets or files such as /assets/, /static/, /files/, or similar paths

2

Map the base directory by requesting valid assets like /assets/logo.png or /assets/style.css

3

Capture legitimate request using proxy tools like Burp Suite or curl

4

Modify the file path parameter to include traversal sequence ../ immediately after the asset base

5

Construct payload URL as https://target.com/assets/../build.sbt

6

Send request and inspect response for non-asset file contents

7

Test for project configuration files using /assets/../.git/config

8

Attempt access to build files with /assets/../build.sbt or /assets/../pom.xml

9

Test traversal to root directory files like /assets/../../../../../etc/passwd

10

Verify Windows environments with /assets/../../../../../windows/win.ini

11

Test encoded variations using %2e%2e%2f for ../ to bypass basic filters

12

Attempt double encoding %252e%252e%252f if single encoding is blocked

13

Verify if trailing slash affects traversal like /assets/../build.sbt/

14

Test null byte injection with /assets/../build.sbt%00.png if language supports it

---

File Path & File Access Vulnerabilities

1

Perform reconnaissance by crawling the target website to enumerate all accessible endpoints

2

Use tools like gau to extract archived URLs from various sources and save to a file

3

Employ Burp Suite Spider or custom scripts to crawl and identify hidden or dynamic parameters

4

Collect all URLs into a list for further analysis

5

Filter URLs to identify parameters tied to file operations such as

file=, document=, folder=, root=, path=, pg=, style=, pdf=, template=, 
php_path=, doc=, page=, name=, cat=, dir=, action=, board=, date=, detail=,
download=, prefix=, include=, inc=, locate=, show=, site=, type=, view=,
content=, layout=, mod=, conf=, url=

6

Automate parameter filtering using gf patterns or Burp Suite search functionality

7

Utilize scripts like _PwnTraverse to highlight potentially dangerous parameters in the URL list

8

Manually inspect isolated parameters for user-controlled input leading to inclusion

9

Capture baseline requests for each parameter using proxy tools like Burp Suite or browser developer tools

10

Test parameters with legitimate file names to confirm normal functionality

11

Inject traversal sequences like ../ to attempt escaping the intended directory

12

Replace parameter values with payloads such as ../etc/passwd or ../../etc/passwd

13

Send modified requests and examine response contents for sensitive file disclosure

14

Verify if responses contain system file contents like /etc/passwd or directory listings

15

Test additional payloads including ../../../var/www/html/config.php and ../../../../root/.ssh/id_rsa

16

Check HTTP response status codes for successful access such as 200 OK

17

Test across different traversal depths by adding more ../ sequences

18

Verify vulnerability on Unix/Linux by targeting /etc/passwd and on Windows by targeting files like C:/Windows/system.ini

---

Path Traversal Filter Bypass

1

Many applications that place user input into file paths implement some kind of defense against path traversal attacks, and these can often be circumvented

2

if application blocks or strips directory traversal sequence there is many bypassing technique is available

3

we might directly access absolute path file=/etc/passwd with out using any traversal

4

You might be able to use various non-standard encoding, such as ..%c0%af or ..%252f, to bypass the input filter

5

filter-bypass-technique might user ....// or ....\ if one ..../ or ....\ is blocked than after removing them we traverse it

6

If an application requires that the user-supplied filename must start with the expected base folder, such as /var/www/images, then it might be possible to include the required base folder followed by suitable traversal sequences. For example filename=/var/www/images/../../../etc/passwd

7

If an application requires that the user-supplied filename must end with an expected file extension, such as .png, then it might be possible to use a null byte to effectively terminate the file path before the required extension. For examplefilename=../../../etc/passwd%00.png

---

File Upload Path Traversal (Upload-Based Path Traversal)

1

locate file-related endpoints like /fileupload

2

Capture the file upload request using a proxy tool like Burp Suite or curl

3

Test file upload functionality by sending a benign file with a command like

curl -X POST -F "file=@test.txt" https://target.com/fileupload/

4

Verify if the uploaded file is publicly accessible by checking the returned URL in a browser

5

Confirm the file’s storage location, noting any CDN or external hosting like cdn.bubble.io

6

Attempt to upload a file with a path traversal sequence in the filename, such as ../../../../../../../etc/passwd

7

Send the traversal payload using curl and Burp Suite Request

curl -X POST -F "file=@../../../../../../../etc/passwd" https://target.com/fileupload/

8

Check the response for a URL pointing to the uploaded file and access it in a browser

9

Test multiple traversal depths (../../, ../../../, etc.) to bypass directory restrictions

10

Attempt to access additional sensitive files like /etc/group, /etc/hosts, /etc/hostname, /etc/resolv.conf, /etc/fstab, /etc/profile, /etc/issue, /etc/nginx/nginx.conf, and /etc/mysql/mariadb.conf.d/50-server.cnf

---

White Box

Cheat Sheet