So I'm currently testing a site that has a url like this


I found that I can do to get to the home page


or I can read files like the CSS for another page


NOTE: The company's policy states that a researcher can only go to the minimal amount of testing required to prove that a vulnerability, so I don't want to try accessing the passwd file or any other sensitive file that isn't already public. I also tried example.com/dir1/dir2?nextPage=google.com but it seems to check if the URL is local so that doesn't work. Would what I found be considered directory traversal?

  • 3
    this is the textbook definition of directory traversal - why were you thinking it might not be?
    – schroeder
    Commented Jul 17, 2017 at 5:39
  • 1
    you should also try: example.com/dir1/dir2?nextPage=http://google.com
    – 40F4
    Commented Jul 17, 2017 at 6:56
  • 1
    @40F4 Which would indicate a remote file inclusion vulnerability ^ Commented Sep 8, 2017 at 18:19

2 Answers 2


It looks like a directory traversal. To prove whether it is really exploitable I would try to open something more interesting like a script file which is not public available. Otherwise you can't be sure that an attacker can really do something interesting. In my opinion that would be in line with minimal testing. Maybe there is a filter which allows only opening .html and .css files.


It's path traversal, but path traversal isn't a vulnerability.

You can check the next attack vectors when you have a path traversal:

Directory enumeration:

If ../../dir3/dir4/css/main.css is true,
../../dir3/../dir3/dir4/css/main.css is true and
../../QWERTYUIOP/../dir3/dir4/css/main.css is false,
it's a directory enumeration.

Arbitrary File Read:

It's like a arbitrary file read but you can check system paths:


The file will return an integer. It isn't /etc/passwd, wakeup_count isn't critical information.

Server Side Request Forgery:

If you want to check networks attack, you need to use URI. Just domain name doesn't work.


If you think what someHTMLfile.html is network resource, you can test its vectors:

example.com/dir1/dir2?nextPage=username:[email protected]/

Local File Inclusion:

You don't check LFI vulnerability without active attack on the server :( I' m sorry.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .