I am performing a penetration testing on an application hosted on an Ubuntu environment.

So using a path traversal vulnerability, I can download any file.

The API web application runs as root (shadow and brute-force are already my friends). Funny situation: I can not find the web root folder.

What I have tried:

What else should I try?

  • What about the /opt location?
    – Jeroen
    Commented Mar 15, 2019 at 23:58
  • @Jeroen-ITNerdbox no luck :) Commented Mar 16, 2019 at 0:09

1 Answer 1


Use the traversal vulnerability to read


This prints out environment variables among other thread information.

Look for a environment variable called DOCUMENT_ROOT

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .