A directory traversal (or path traversal) attack exploits insufficient security validation or sanitization of user-supplied file names, such that characters representing "traverse to parent directory" are passed through to the operating system's file system API. An affected application can be exploited to gain unauthorized access to the file system. Example A typical example of a vulnerable application in PHP code is: <?php $template = 'red.php'; if (isset($_COOKIE['TEMPLATE'])) { $template = $_COOKIE['TEMPLATE']; } include "/home/users/phpguru/templates/" . $template; An attack against this system could be to send the following HTTP request: GET /vulnerable.php HTTP/1.0 Cookie: TEMPLATE=../../../../../../../../../etc/passwd The server would then generate a response such as: HTTP/1.0 200 OK Content-Type: text/html Server: Apache root:fi3sED95ibqR6:0:1:System Operator:/:/bin/ksh daemon:*:1:1::/tmp: phpguru:f8fk3j1OIf31.:182:100:Developer:/home/users/phpguru/:/bin/csh The repeated ../ characters after /home/users/phpguru/templates/ have caused include() to traverse to the root directory, and then include the Unix password file /etc/passwd. Unix /etc/passwd is a common file used to demonstrate directory traversal, as it is often used by crackers to try cracking the passwords. However, in more recent Unix systems, the /etc/passwd file does not contain the hashed passwords, and they are instead located in the /etc/shadow file, which cannot be read by unprivileged users on the machine. Even in that case, though, reading /etc/passwd does still show a list of user accounts. Variations Directory traversal in its simplest form uses the ../ pattern. Some common variations are listed below: Microsoft Windows Microsoft Windows and DOS directory traversal uses the ..\ or ../ patterns. Each partition has a separate root directory (labeled C:\ where C could be any partition), and there is no common root directory above that. This means that for most directory vulnerabilities on Windows, attacks are limited to a single partition. Directory traversal has been the cause of numerous Microsoft vulnerabilities. Percent encoding in URIs Some web applications attempt to prevent directory traversal by scanning the path of a request URI for patterns such as ../. This check is sometimes mistakenly performed before percent-decoding, causing URIs containing patterns like %2e%2e/ to be accepted despite being decoded into ../ before actual use. Double encoding Percent decoding may accidentally be performed multiple times; once before validation, but again afterwards, making the application vulnerable to Double percent-encoding attacks in which illegal characters are replaced by their double-percent-encoded form in order to bypass security countermeasures. For example, in a double percent-encoding attack, ../ may be replaced by its double-percent-encoded form %252E%252E%252F. This kind of vulnerability