One parameter.
Files exposed.
Manipulate a path parameter to climb the server's directory tree and read sensitive files — /etc/passwd, .env, SSH keys.
Working directory:
/var/www/html/uploads/
Resolved path:
/var/www/html/uploads/rapport_Q1.pdf
✓ File found — 200 OK
rapport_Q1.pdf · 847 Ko
A file parameter in the URL
The application loads a file whose name is passed directly in the ?file= parameter.
Every path parameter is an attack surface
When an application concatenates user input directly into a file path without validation, it trusts that input. An attacker can supply any path — including ../ sequences to climb back up the server's directory tree.
Key figures
#0
OWASP Broken Access Control
includes Path Traversal (A01:2021)
0 sec
To exploit an endpoint
with a basic ../../../ payload
0 %
Of encoded payloads
%2e%2e bypass naive filters on '../'
Technical demo
Try it yourself
Manipulate the path parameter, watch the step-by-step resolution across the directory tree, and see the sensitive files exposed by the vulnerable server.
Interactive demonstration
Path Traversal simulator
Manipulate the path parameter to escape the allowed directory and access sensitive files on the server.
Ready-to-use payloads
Allowed base
/var/www/forenshield/public
Requested URL
https://forenshield.com/assets/documents/report.pdf
Resolved path
/var/www/forenshield/public/documents/report.pdf
Targeted files
- ·/etc/passwd
- ·/etc/shadow
- ·/.env
- ·/config/database.json
- ·/root/.ssh/id_rsa
Why it's critical
A single unfiltered path variable is enough to escape the web folder and read secrets, credentials, or private keys.
Defense
- ·Validate and normalize paths server-side
- ·Reject any '../' sequence or suspicious URL encoding
- ·Use an allowlist of permitted files
- ·Never dynamically concatenate a user-supplied path