Description

This detector identifies path traversal vulnerabilities in URL query parameters. Path traversal occurs when an application uses user-controlled input to build a filesystem path without proper sanitization, allowing attackers to access files outside the intended directory by injecting sequences such as '../'.

Detection Strategy

• Extracts all query parameters from the target URL

• Replaces each query parameter value with one of 8 traversal payloads (plain, percent-encoded, double percent-encoded, and non-standard separator variants targeting both Linux and Windows sensitive files), one parameter at a time, leaving the others untouched

• Makes HTTP requests to the mutated URLs and examines the raw 200 response body

• Reports a vulnerability when the response body matches a signature indicating a sensitive file was returned (e.g. '/etc/passwd' or 'boot.ini' contents)

• Skipped entirely when the initial GET response is 4xx/5xx, or when the URL has no query parameters

• Only the first 25 query parameters are probed to bound request fan-out against the target

• Only the first matching parameter/payload combination is reported