Web Application Hacking (Hands-On)
Path Traversal / LFI — Concept + Live Lab
Escape a folder with ../ to read arbitrary files off the server.
Open the interactive lesson & lab →
Path traversal (a.k.a. directory traversal, and closely tied to Local File Inclusion) happens when an app builds a file path from user input without sanitising it. By injecting ../ sequences you climb out of the intended directory and read files anywhere the app's user can.
A file viewer might do:
$file = $_GET['file'];
include('/var/www/html/pages/' . $file);Request ?file=../../../../etc/passwd and the path resolves outside 'pages' to /etc/passwd. Each ../ goes up one directory; you need enough to reach the root, then walk back down to your target.
High-value targets
- /etc/passwd — proves the read and lists users (Linux).
- Application config files — database credentials, API keys.
- SSH private keys — ~/.ssh/id_rsa for direct login.
- Log files — sometimes chainable into LFI-to-RCE.