Directory Traversal

Question 1

What’s directory traversal?

Answer 1

web application vulnerability that allows an attacker to access files and directories outside the intended scope of a web application

Question 2

What are the other names for directory traversal?

Answer 2

Path Traversal or Directory Climbing

Question 3

When can attacker exploit directory traversal vulnerability?

Answer 3

• when the application does not properly validate or sanitize user-supplied input that includes file or directory paths
• the input is often provided through parameters in URLs or form inputs

Question 4

What’s the attacker’s goal in directory traversal attack?

Answer 4

to traverse up the directory structure and access files or directories outside the intended scope of the application