Directory Traversal

What Is Directory Traversal?

Directory traversal is what happens when a handler joins a user-controlled filename onto a fixed directory and reads the result. The attacker adds path segments or an absolute path so the resolved location sits outside the intended folder, and the handler returns the file it reaches without ever noticing it strayed. This exercise puts you on both sides. As Bob, a customer with an ordinary account on Halvora's billing platform, you notice the invoice download endpoint takes a filename in the query string. You replace your invoice name with ../../../etc/passwd and the server hands back the system account file in place of a PDF, the same primitive that reaches config files, secrets, and SSH keys. As Alice, an application security engineer on the receiving end of a data-loss alert, you open the handler, see the raw path concatenation onto /var/app/invoices/, and ship the fix: resolve the path with path.resolve and confirm the canonical result still sits inside the invoice folder before reading. The exercise closes on why stripping .. is not enough and why canonicalise-then-verify is.

What You'll Learn in Directory Traversal

• Recognise directory traversal as the result of joining user input onto a filesystem path without canonicalisation or containment checks
• Read a handler and identify the unsafe path-concatenation pattern
• Understand why a string filter that rejects .. loses to encoded segments and absolute paths
• Apply the canonicalise-then-verify fix: resolve the path and confirm it stays inside the intended directory before reading
• Audit every file read or write whose path is built from request data

Directory Traversal — Training Steps

1. Find the download feature

   Halvora is a billing platform, and every customer can download their own invoices from a self-service page. Bob has an ordinary Halvora account. He opens the invoice download feature to see how it behaves before he touches it.

2. Download a normal invoice

   First, watch the feature behave normally. Bob downloads one of his own invoices. The file lands in his downloads, and the browser's Network panel records the request the page sent, exactly what a developer sees in DevTools.

3. The filename is just a parameter

   The invoice came back. One detail in the request tells Bob how to attack it.

4. Tamper the request and resend

   Bob never needed the download button. He edits the captured request directly, swapping the invoice name for a path that climbs out of wherever the invoices are stored. Each ../ steps up one directory; enough of them reach the filesystem root, and from there etc/passwd is the account file every Linux box has.

5. The file comes back

   The response is not an invoice. It is the server's account file, read off disk and handed back through the same download the feature offers every customer.

6. Knowledge check

   You just watched a tampered download request return the server's account file. Lock in why.

7. The breach alert

   You own Halvora's invoice download service. Overnight, data-loss monitoring flagged the endpoint returning the contents of a server file in place of a PDF. Security operations has emailed you the details.

8. Open the download handler

   Open the download handler and look at how it turns the filename into a file on disk.

9. Spot the flaw

   The filename is concatenated onto the invoice directory and read directly. Nothing constrains the path, so a value with ../ segments reaches outside the folder.

10. Knowledge check

    Before you touch the handler, be clear about why the quick patch is not the fix.