Directory Traversal
Directory traversal is unauthorized access to files outside an application’s intended directory by manipulating path input.
Mechanism
The application accepts a user-controlled path and fails to constrain it to an approved directory or canonicalize it safely.
Indicators to watch
Repeated path-normalization failures, requests containing suspicious path patterns, access to configuration files, and unexpected file-read errors.
Concept diagram
Defensive controls
Canonicalize paths, use allow-listed file identifiers instead of raw paths, enforce filesystem permissions, isolate application data, and monitor file access.
Recommended security control
WAF + application file-access logging
Use non-sensitive lab files for testing.
Defence practice lab
The administrator has not attached a tool link yet. This slot will show “Build Soon” until an external link is configured.
Defence techniques
Defence techniques for this attack will be added by the administrator.
All attack descriptions are for defensive education. Test scanning, traffic generation, interception, wireless testing, and vulnerable applications only on systems and networks you own or are explicitly authorized to assess.