What is directory traversal?¶
The practical answer¶
Directory traversal is an attempt to access files or folders outside the location the web application is intended to expose.
The key evidential caution¶
The dangerous assumption is that a traversal-looking request proves the server disclosed a protected file.
It may not.
The request may include path elements, encoding or other techniques intended to move through the file structure.
An offender may seek:
Key points¶
- configuration files
- password files
- application source code
- logs
- keys
- backups
- system information
What investigators should establish¶
Investigators should establish:
Key points¶
- the exact request
- how the application interpreted it
- the response code and size
- whether content was returned
- which file was targeted
- whether the vulnerable condition existed
- what later activity followed
A web log may record the malicious path even where the application blocked it.
A response marked successful may still contain an error page or generic content.
Evidential limits¶
Do not infer file disclosure from the request alone.
Practical interpretation¶
Where possible, preserve the returned content, application logs and server-side file-access evidence.
Also consider whether web gateways or security tools normalised, decoded or blocked the request before it reached the application.
Directory traversal may use encoded or alternative path forms that are normalised differently by browsers, gateways and applications. Preserve the original request and any decoded form recorded downstream. A gateway may block one representation while another reaches the application, so the processing path matters.
Where protected content is returned, preserve the response body, size, headers and any downstream use. One disclosed file may support a limited compromise without proving wider filesystem access.
Operational takeaway¶
Prove how the traversal request was processed and whether protected content was actually returned, rather than treating the path string as proof of disclosure.