I am trying to perform a [Path Traversal][1] attack on a very simple web only for educational purposes.

What I have to do is to access to a file named `passwords.txt` located in `\files\private\admin\passwords.txt` when I am on `\files\public\` and the URL parameters are the following:

*/download.php?folder=&file=&action=download*

The path is built concatenating the values of the parameters `folder` and `file` to the path `\files\public\`. None of them are vulnerable to SQL Injection according to SQLMap, neither `action`. So, if I put:

/download.php?folder=**private\admin\&file=passwords.txt**&action=download

 
The resulting path will be `\files\public\private\admin\passwords.txt`

I have tried the simplest trick like putting `\..\` (in plain text and URL encoded form) in order to access to the parent folder, but it is not allowed to introduce `..`.

So, I suppose I have to bypass the security mechanism implemented on the database that injects the path `\files\public\` if I want to access to that file (DBMS is MySQL).

It is possible to delete the `\public\` part of the path using comments with `#` or another way so I can finally access to the `private` directory?

  [1]: https://en.wikipedia.org/wiki/Directory_traversal_attack