Description

This detector identifies path traversal vulnerabilities in the URL path. Path traversal occurs when an application uses user-controlled input to build a filesystem path without proper sanitization, allowing attackers to access files outside the intended directory by injecting sequences such as '../'.

Detection Strategy

• Appends 8 traversal payloads (plain, percent-encoded, double percent-encoded, and non-standard separator variants targeting both Linux and Windows sensitive files) to the crawled URL path, one at a time, leaving the query string untouched

• Builds the mutated path via raw string concatenation, never through a URL path setter that would normalize away literal '../' sequences

• Makes HTTP requests to the mutated URLs and examines the raw 200 response body

• Reports a vulnerability when the response body matches a signature indicating a sensitive file was returned (e.g. '/etc/passwd' or 'boot.ini' contents)

• Skipped entirely when the initial GET response is 4xx/5xx

• Only the first matching payload is reported