File Path Traversal Testing
This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies.
Author
zebbern
Category
Other ToolsInstall
Download and extract to your skills directory
Copy command and send to OpenClaw for auto-install:
Path Traversal Testing Tool
Skills Overview
File Path Traversal Testing is a professional security testing skill used to identify and test path traversal (directory traversal) vulnerabilities in web applications. It helps penetration testers, security researchers, and CTF players discover arbitrary file read security issues within authorized scopes.
Use Cases
In authorized penetration testing projects, systematically detect file operation features in web applications, identify potential path traversal vulnerabilities, and assess the risk of data leakage.
Solve CTF challenges involving path traversal and file inclusion, master various encoding bypass and filter evasion techniques, and achieve exploitation upgrades from Local File Inclusion (LFI) to Remote Code Execution (RCE).
Research path traversal attack vectors, develop tailored detection rules and mitigation plans, and help enterprises fix filesystem security flaws in their code.
Core Features
Start by identifying potentially relevant file operation parameters (e.g., file, path, page, template), then progressively test basic traversal, encoded variants, bypass techniques, and absolute path injection—covering both Linux and Windows target systems.
Built in a variety of WAF and filter bypass methods, including double encoding, Unicode encoding, nested traversal, null byte injection, path truncation, and more. It can handle protection scenarios under different security policies.
Provides multiple technical approaches to escalate file reads into remote code execution, such as Apache/Nginx log poisoning, injecting environment variables via
/proc/self/environ, and PHP wrappers (e.g., php://filter, php://input, data://).Frequently Asked Questions
What are the impacts of path traversal vulnerabilities?
Path traversal vulnerabilities may allow an attacker to read arbitrary files on the server, including sensitive configuration files (e.g., database credentials), source code, SSH private keys, user data, and more. In some cases, combined with file uploads or log poisoning, the issue can be further upgraded to Remote Code Execution (RCE), resulting in full control of the server.
How can path traversal filters be bypassed?
Common bypass methods include URL encoding (%2e%2e%2f), double encoding (%252e), Unicode encoding (%c0%af), nested sequences (....//), null byte injection (%00), and path truncation (large numbers of dots), among others. Different filtering rules require selecting the corresponding bypass techniques.
How does LFI upgrade to RCE?
Main methods for upgrading LFI to RCE include:
(1) Log poisoning: inject malicious code into the User-Agent, then include the log file to execute it.
(2) /proc/self/environ: inject code via environment variables.
(3) PHP wrappers: use php://input or data:// to execute dynamic code.
(4) Session file poisoning: write malicious content into the session file.