I am performing a penetration testing on an application hosted on an Ubuntu environment.

So using a path traversal vulnerability, I can download any file.

The API web application runs as root (shadow and brute-force are already my friends). Funny situation: I can not find the web root folder.

What I have tried:

What else should I try?

  • What about the /opt location?
    – Jeroen
    Mar 15, 2019 at 23:58
  • @Jeroen-ITNerdbox no luck :) Mar 16, 2019 at 0:09

1 Answer 1


Use the traversal vulnerability to read


This prints out environment variables among other thread information.

Look for a environment variable called DOCUMENT_ROOT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.