Description

This detector identifies path traversal vulnerabilities in URL query parameters by testing if malicious directory traversal payloads can access sensitive files on the server. When successful, attackers can read files outside the intended directory structure, potentially exposing configuration files, source code, or system files.

Detection Strategy

• Parses query parameters from the target URL to identify testable parameters

• Injects common path traversal payloads (like ../../../etc/passwd) into each query parameter individually

• Makes HTTP requests with the modified URLs containing traversal payloads

• Analyzes response content using signature matching to detect if sensitive files were successfully accessed

• Reports a vulnerability when any response returns status code 200 and contains content matching known file signatures (indicating successful file access)