> For the complete documentation index, see [llms.txt](https://yasmeen-rezk.gitbook.io/my-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yasmeen-rezk.gitbook.io/my-notes/bug-bounty-playbook-v2/basic-hacking/owasp/directory-traversal.md).

# Directory Traversal

If an application uses user-supplied input to interact with files on the system then there is a chance the endpoint is vulnerable to directory traversal.

* If you find this vulnerability make sure to look for config files, source code, or if it is in an upload functionality try overwriting files on disk.

### Source Code Snippet

<figure><img src="https://509923538-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ2ZeCCTH4XZTY31hlbGx%2Fuploads%2FuQQPFz2ExPFZWzbpM9wC%2Fimage.png?alt=media&amp;token=9d9fb04f-7699-4279-a3a1-83f0086b67c5" alt=""><figcaption></figcaption></figure>

#### &#x20;Exploitation

The GET parameter “page” is loaded into a variable called “file”:&#x20;

* on line 10 the file is opened and read out to the page and as it appears there are no additional checks.
* In case improperly implemented, attackers leverage the “../” technique to load any file they want.

EX: <https://example.com/?page=index.html>&#x20;

* can exploit this vulnerability to retrieve the “/etc/passwd” file from the operating system.
* [https://example.com/?page=](https://example.com/?page=index.html)../../../../../../etc/passwd
* Retrieving /etc/passwd content.

#### 💡NOTE

* “../” characters will traverse back one directory so can be used to retrieve sensitive files by traversing up or down the file structure.
* The “/etc/passwd” file is used to store information on each user account in a Linux system.