Directory Traversal
A vulnerability that allows attackers to access restricted directories on a server.
Understanding Directory Traversal
Web applications often use user-supplied input to access files. If proper validation is not implemented, an attacker can manipulate file paths using special characters (../ or ..) to navigate outside the intended directory.
How Directory Traversal Works
User Input Manipulation – Attackers modify a URL parameter to navigate outside the expected directory.
Bypassing Access Controls – Exploiting weaknesses in file access mechanisms.
Extracting Sensitive Data – Reading files such as configuration files, password files, or database credentials.
Best Practices for Preventing Directory Traversal
Sanitize User Input – Restrict special characters like ../ and absolute paths.
Implement Least Privilege Access – Limit user access to only necessary directories.
Use Web Application Firewalls (WAFs) – Detect and block path traversal attempts.
Disable Directory Listings – Prevent attackers from seeing available files.