Directory Traversal Attack Explained – Deep Technical Guide to Path Traversal Vulnerabilities
Directory traversal, also called path traversal, is a critical web application vulnerability that allows attackers to access files outside the intended directory. By manipulating file paths using sequences like "../", attackers can bypass restrictions and access sensitive system files.
This guide explains directory traversal attacks from both attacker and defender perspectives.
Understanding Normal File Requests
Legitimate Request Flow
In normal scenarios, a user requests files from a web application:
https://example.com/view.php?file=image.jpg
The server processes this request and loads the file from an allowed directory, such as:
/var/www/html/images/image.jpg
Security relies on restricting access to files within the web root.
How Directory Traversal Attacks Work
Attack Concept
Attackers attempt to escape the allowed directory by using relative path sequences.
Example Malicious Request
https://example.com/view.php?file=../../../../etc/passwd
Technical Explanation
- "../" moves up one directory level.
- Repeated traversal allows escape from web root.
- Server resolves path to sensitive system file.
If the application does not validate input, unauthorized files become accessible.
Exploitation Flow
- Attacker identifies file parameter.
- Tests directory traversal sequences.
- Server processes input without validation.
- Path resolves outside intended directory.
- Sensitive file returned to attacker.
Common Target Files
- /etc/passwd (Linux user accounts)
- Configuration files containing credentials
- Source code files
- Database backups
Why Directory Traversal Happens
Developer Mistakes
- No input validation
- Direct use of user input in file paths
- Lack of path normalization
- Trusting client-side restrictions
Real-World Attack Scenario
A vulnerable file download feature allows users to retrieve documents. Attacker modifies request parameter to traverse directories and accesses configuration files containing database credentials.
Security Consequences
- Sensitive data exposure
- Server compromise
- Information disclosure
- Privilege escalation
Advanced Variations of Path Traversal
- URL encoding bypass (..%2f)
- Double encoding attacks
- Unicode traversal sequences
- Null byte injection
Prevention Strategies (Secure Coding)
Input Validation
- Whitelist allowed filenames
- Reject traversal sequences
Use Absolute Paths
Avoid dynamically constructing paths from user input.
Path Normalization
Resolve paths before processing to prevent directory escape.
Disable Directory Browsing
Limit exposure of file structures.
Principle of Least Privilege
Ensure application cannot access sensitive system files.
Detection Methods for Security Teams
- Log monitoring for "../" patterns
- Web application firewall rules
- Anomaly detection in file requests
Interview-Level Explanation
Directory traversal attacks exploit improper input validation, allowing attackers to navigate outside intended directories and access unauthorized files on the server.
Final Expert Summary
Directory traversal vulnerabilities highlight the importance of secure input handling and strict access control. Preventing these attacks requires secure coding practices, path validation, and proper server configuration.
Never trust user input — always validate file paths 🔐
