A Beginner’s Guide to Testing for Directory Traversal Attacks

In a few weeks, I’ll be taking the Offensive Security Web Assessor (OSWA) certification exam from Offensive Security. As part of my preparation, I’ve been diving into a variety of web vulnerabilities that are included in the exam. One of the vulnerabilities and something I’ve encountered in my day-to-day work as an application penetration tester — are Directory Traversal vulnerabilities . Writing about this vulnerability not only helps lock-in my preparation for the exam but also allows me to share insights with other OSWA candidates or others in the security community. With this guide, I will break down the risks, detection methods, exploitation techniques, and remediation strategies for Directory Traversal vulnerabilities.

What is Directory Traversal?

Directory Traversal, also known as Path Traversal, is a vulnerability in a web application that allows an attacker to manipulate file paths in a web application to access files and directories outside the intended scope, and on the server hosting the application. By exploiting this vulnerability, an attacker can potentially read sensitive files (like /etc/passwd on Linux systems or C:\Windows\System32\config\SAM on Windows), access application configurations, or even execute unintended server actions.

This vulnerability exists because of user controlled input for a parameter that interacts with the file system is poorly sanitized or validated. If you think about it, most web application vulnerabilities stem from poor input validation.

Imagine a file download feature in a web application that takes a filename as user input, such as download.php?file=report.pdf. If the application doesn’t validate this input properly, an attacker could craft a malicious request, like download.php?file=../../etc/passwd, to access unauthorized files on the server.

How Does Directory Traversal Work?

In a legit context, directory traversal is just a normal part of navigating file systems. For example, if you are in a folder on a Linux file system and want to move up to its parent directory, you might use ../ as part of the path string.

In the examples below , using directory traversal, we are able to read the contents of the /etc/passwd

In the above screenshots we used directory strings to move from the home directory to the /etc/ directory and read the contents of the passwd file.

A directory string represents the logical structure of folders and files within an operating system. Here are some examples:

• /home/user/documents/ — an absolute path
• ../images/logo.png — a relative path moving one level up
• ./config.yaml — a relative path pointing to a file in the current directory

Web applications often use similar strings to manage file navigation, such as serving images, downloading reports, or loading configuration files. However, when user input directly modifies these paths, vulnerabilities can arise.

For instance, if a file download feature relies on user input like download.php?file=report.pdf and doesn’t properly sanitize or validate this input, attackers could exploit it with something like ../../etc/passwd to traverse directories and access sensitive files.

What Are the Risks and Impacts of Directory Traversal Attacks?

I know my security community peeps love talking CIA, so I will frame impact with the ol’ security triad. Directory Traversal vulnerabilities can significantly compromise the security of a web application by impacting the Confidentiality, Integrity, and Availability of the system. Here’s how these vulnerabilities align with the CIA triangle:

Confidentiality

• Attackers can access sensitive and confidential files stored on the server. These files may include:
• System configuration files, such as /etc/passwd (Linux) or C:\Windows\System32\config\SAM (Windows).
• Application credentials that are stored in files like .env or config.php.
• Logs or other data that may contain sensitive information, including user session details.
• By exploiting confidentiality breaches, attackers can gain valuable insights into the system or application, potentially leading to privilege escalation or other attacks.

Integrity

• Attackers can manipulate the file system to alter or overwrite critical files, leading to:
• Altering or modifying of application code or configurations, resulting in unexpected behaviors.
• Modification of server-side scripts or executable files to execute malicious code.
• Such compromises may allow the attacker to escalate the attack to Remote Code Execution (RCE), gaining full control over the application or even the server.

Availability

• Exploiting Directory Traversal vulnerabilities can allow attackers to target files critical to the availability of the system, such as:
• Deleting files required for the application to function.
• Overloading the system by repeatedly accessing large or resource-intensive files, causing performance degradation or crashes.
• These attacks can result in a Denial of Service (DoS), disrupting access to the application for legit users.

Full System Compromise

In severe cases, attackers can combine these impacts to achieve full system compromise, allowing them to:

• Execute arbitrary commands on the server.
• Install persistent backdoors or malicious payloads.
• Escalate their privileges and compromise other parts of the system infrastructure.

How to Detect Directory Traversal Vulnerabilities

Detecting Directory Traversal vulnerabilities involves identifying user inputs that are used to construct file paths within the application and testing whether these inputs allow manipulation of directory paths. Here’s how to approach this task using Burp Suite and other tools.

User inputs can be identified by analyzing ‘suggestive parameters,’ a term used in Offensive Security’s materials to describe parameters whose names hint at their purpose or expected values.

Here are some examples of suggestive parameters to analyze and test for Directory Traversal vulnerabilities:

?file=

?f=

/file/someFile

?location=

?l=

/location/someLocation

search=

s=

/search/someSearch

?data=

?d=

/data/someData

?download=

?d=

/download/someFileData

Using Burp Suite to manually detect, test, and exploit Directory Traversal vulnerabilities

1. Intercept Requests

• While examining and analyzing the web applicartion, Look for parameters in the intercepted requests that appear to reference files or paths that interact with the file system.

Examining the HTTP history log in Burp to analyzing suggestive parameters

2. Send Requests to Repeater

• Once you’ve identified a request that includes a file path or directory parameter, right-click and send the request to Repeater for manual testing.

Sending a request to Burp Repeater

· Send the original request to the server and observe the baseline response:

Analyzing and forming a base response

It is a good idea to observe what the intended behavior of a request to the web app server should look like.

Using Burp Repeater again, modify the parameter with a payload that provides a path and will reference a file that is world-readable:

using a directory traversal payload to read /etc/passwd

Fuzzing for Directory Traversal Vulnerabilities

Fuzzing parameters in Burp Suite is a quick and effective way to test for Directory Traversal vulnerabilities.

Intercept the Request

Use Burp’s Proxy to capture a request containing a parameter that interacts with files or paths (e.g., file=, filename=, path=, or download=).

Selecting a URL and parameter to fuzz

Send to Intruder

• Right-click the intercepted request and select “Send to Intruder”.

sending the URL to Burp Intruder

• Go to the Intruder tab and select the parameter you want to fuzz by marking it with a payload position (§).

selecting the paramter to fuzz

Load Directory Traversal Payloads

• In the Payloads tab, select “Simple list” as the payload type.
• Add payloads like:

setting the payloads to use for fuzzing

This is just an example as in an actual pen test it would be far more efficient to load a list specialized for Directory Traversal like from SecLists or PayloadAllTheThings or even one of the built in lists provided with Burp. These lists would provide much more comprehensive payload list.

Start the Attack

• Click “Start attack” to send requests with the fuzzed parameter values.

results of fuzzing

Analyze Responses

• Look for anomalies in the server’s responses, such as:
• 200 OK with unexpected file content.
• Error messages revealing directory or file paths.
• Changes in response length, indicating potential access.

Successful Directory Traversal via fuzzing

How to Remediate Directory Traversal Vulnerabilities

1. Validate Inputs

• Only allow expected file names or paths (whitelisting is your best friend).
• Block any sneaky patterns like ../ or absolute paths in user input.

2. Stick to Safe Paths

• Use predefined, safe directories for file operations.
• Keep sensitive files far away from the web root to avoid accidental exposure.

3. Normalize File Paths

• Clean up and normalize paths with built-in tools (e.g., os.path.abspath() in Python) to remove any traversal attempts.
• Check the final path to ensure it stays within your allowed directories.

4. Restrict Permissions

• Run your application with minimal access.
• Limit file and folder permissions so even if something goes wrong, attackers hit a wall.

5. Hide Your Tracks

• Don’t reveal sensitive info in error messages. A simple “File not found” will do.

Directory Traversal vulnerabilities might seem like they are not as severe as other vulnerabilities but their potential impact on Confidentiality, Integrity, and Availability makes them critical to address, and why it is a topic included in the OSWA exam.

While this guide covers the basics of identifying, testing, and remediating Directory Traversal vulnerabilities, there’s more to explore — such as bypass techniques, chaining with other exploits, and advanced testing methods. I only covered the basics in the context of the OSWA exam, it’s environment and Rules of Engagement for the exam.

If you found this guide useful, feel free to share it with others!