Path Traversal labs
Path Traversal / Directory Traversal
What is Path Traversal?
Path Traversal lets you reach files and directories outside the application's root. Using sequences like ../ you can read system files such as /etc/passwd, configs, private keys and source code.
Why practice Path Traversal?
Path Traversal can hand over sensitive server files: configs with credentials, SSH keys, source code. When chained with other vulns (file upload, LFI to log → poisoning), it can lead to remote code execution (RCE) and five-figure bounties.
What will you learn with the Path Traversal labs?
You'll learn filter bypass techniques (URL-encoding, double encoding, null byte, ../ alternatives), typical targets per OS (etc/passwd, web.config, .env, .git/config, ~/.ssh/id_rsa), and LFI-to-RCE chains via log poisoning, /proc/self/environ and session injection.
Types of Path Traversal we cover
- Pure path traversal
../../../etc/passwd to read files. The vulnerable parameter is usually file/path/template/page.
- LFI (Local File Inclusion)
The read file is interpreted as code (PHP include). Enables RCE via log/session/proc poisoning.
- Encoded bypass
Filters that strip ../ once are bypassed with ....// or %2e%2e%2f or double URL-encode %252e%252e%252f.
- Null byte (legacy)
../../etc/passwd%00.png — the null byte truncates the string in C, bypassing the extension whitelist.
How do you find and exploit Path Traversal?
A practical playbook — from recon to proof of concept.
- 1
Locate file parameters
Any parameter that reads/downloads/includes a file is a candidate: file, path, page, template, doc, download, lang.
GET /download?file=report.pdf - 2
Try the basic traversal
Replace the value with a ../ path toward known system files. /etc/passwd on Linux, win.ini on Windows.
?file=../../../../../../etc/passwd - 3
Bypass ../ filters
If they strip ../ once, use nested sequences, URL-encoding and double encoding to reconstruct the sequence after the filter.
....//....//etc/passwd · %2e%2e%2f · %252e%252e%252f - 4
Escape forced prefixes/suffixes
If the app prepends a base path, traverse from there; if it appends an extension, try the null byte (legacy engines) or wrappers.
?file=../../../../etc/passwd%00.png - 5
Aim at juicy files
Beyond /etc/passwd, go for configs and secrets: environment variables, keys, source code and repos.
.env · .git/config · /proc/self/environ · ~/.ssh/id_rsa · web.config - 6
Escalate from LFI to RCE
If the file is interpreted as code (PHP include), poison a log or the session with code and include it again.
User-Agent: <?php system($_GET['c']); ?> → ?file=/var/log/apache2/access.log&c=id
Learn the theory
Academy: File Upload Vulnerabilities
Loading labs...
View in full catalog →Frequently asked questions
What is Path Traversal?
It's a vulnerability that lets you reach files outside the app's intended directory using sequences like ../, reading /etc/passwd, config files with credentials, SSH keys or source code.
How is a Path Traversal exploited?
You manipulate a parameter that references a file, inserting ../ to climb directories and aim at sensitive files. If there are filters, you bypass them with double encoding (%252e), nested sequences (....//) or null bytes on old engines.
How do you find Path Traversal in bug bounty?
Fuzz every parameter handling paths or filenames (file, page, template, download) with traversal payloads and their encoded variants. A response containing the contents of /etc/passwd confirms the bug.
How do you prevent Path Traversal?
Avoid passing user input into file paths; use indirect identifiers mapped server-side, canonicalize the path (realpath) and verify it stays inside the base directory, and apply a name/extension allowlist.
Difference between Path Traversal and LFI?
Path Traversal reads the file as data (returns its contents). LFI includes and executes it as code (typical in PHP include), which opens the door to RCE via log poisoning or wrappers. LFI is essentially a Path Traversal over a code-inclusion function.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Path Traversal in real labs
Every Path Traversal lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime