file-path-traversal
Test web applications for path traversal vulnerabilities
Web applications often expose sensitive files through path traversal vulnerabilities. This skill provides security professionals with comprehensive testing methodologies to identify and document these security gaps before attackers exploit them.
Télécharger le ZIP du skill
Importer dans Claude
Allez dans Paramètres → Capacités → Skills → Importer un skill
Activez et commencez à utiliser
Tester
Utilisation de "file-path-traversal". Test /download?file= parameter for path traversal
Résultat attendu:
VULNERABILITY CONFIRMED: Parameter 'file' is vulnerable to path traversal. Payload '../../../etc/passwd' returned system password file contents (HTTP 200, 1847 bytes). Impact: Unauthorized access to sensitive system files. Recommendation: Implement basename() validation and whitelist allowed filenames.
Utilisation de "file-path-traversal". Generate remediation guidance for PHP application
Résultat attendu:
SECURE CODING FIX: Replace direct file inclusion with validated approach. Use basename($_GET['file']) to strip directory paths, validate against whitelist of allowed files, and use realpath() to canonicalize paths before inclusion. See OWASP Path Traversal prevention cheatsheet for complete guidance.
Audit de sécurité
Risque faibleThis is a legitimate security testing skill for penetration testers. Static analysis detected 246 patterns, but all are code examples within educational documentation, not executable malicious code. The skill provides testing methodologies for path traversal vulnerabilities (CVE-2021-44228 style testing), including bypass techniques, target file lists, and prevention measures. Content is appropriate for security professionals with proper authorization.
Problèmes à risque moyen (1)
Problèmes à risque faible (2)
Facteurs de risque
📁 Accès au système de fichiers (2)
⚙️ Commandes externes (4)
Motifs détectés
Score de qualité
Ce que vous pouvez construire
Penetration Testing Engagement
Security consultants testing web applications for clients need systematic path traversal testing to fulfill OWASP Top 10 coverage requirements and deliver comprehensive vulnerability assessments.
Security Code Review
Development teams reviewing legacy code or third-party components can use this skill to identify path traversal vulnerabilities before deployment and implement proper input validation.
Bug Bounty Hunting
Independent security researchers participating in bug bounty programs can systematically test for path traversal vulnerabilities across multiple targets with documented methodologies.
Essayez ces prompts
Test the endpoint [ENDPOINT_URL] with parameter [PARAMETER_NAME] for path traversal vulnerabilities. Start with basic payloads like ../../../etc/passwd and document any responses that differ from normal behavior.
The application blocks ../ sequences. Generate URL-encoded and double-encoded path traversal payloads to test filter bypass. Include variations like %2e%2e%2f and ..%252f patterns.
We have confirmed LFI on [ENDPOINT]. Test escalation to remote code execution using log poisoning or PHP wrapper techniques. Document each attempt and response for the vulnerability report.
Create a remediation report for discovered path traversal vulnerabilities. Include root cause analysis, secure code examples in [LANGUAGE], and references to OWASP guidelines.
Bonnes pratiques
- Always obtain written authorization before testing any system you do not own
- Document all testing activities with timestamps, payloads used, and responses received
- Limit testing to minimum necessary to confirm vulnerability - avoid exfiltrating sensitive data
- Follow responsible disclosure practices when reporting findings to stakeholders
Éviter
- Testing production systems without explicit written authorization from the owner
- Exfiltrating sensitive data (credentials, PII) beyond what is needed to prove the vulnerability
- Using automated tools at high volume that could cause denial of service or data corruption
- Sharing vulnerability details publicly before the organization has time to remediate