Path Traversal and Arbitrary File Access

Path traversal is what happens when an application lets you decide which file it opens, but does not properly confine that decision to the directory it intended. With a crafted filename you climb out of the sandbox and read files the application never meant to serve.

This lesson shares its target with security-misconfig-exposed-files, which explored the same /ftp directory. Completing that lesson first is optional but provides useful context. Here, the server actively tries to hide the interesting files behind a file-extension filter — and you will defeat that filter.

In this lesson you will:

• Use Path Resolver to compare an allowed baseline with simulated suffix and containment bypasses.
• Explore a poison null byte and encoded directory-traversal sequences (..%2f) without requesting a live file.
• Learn why a blocklist of dangerous characters always loses, and why canonicalize-then-validate is the durable fix.

Null-byte technique — skip on a first pass if this is unclear. The payload %2500 is a double-encoded null byte. Decode step by step: the client sends %2500 → one URL-decode pass produces %00 → the framework strips the null byte before checking the file extension, so the extension filter sees .bak%00.md and allows it, while the file system opens the path up to the null byte and reads the .bak file. The practical step walks you through this — you do not need to memorise the decode chain now.

Estimated time: 10 to 15 minutes.

Hands-on environment: Path Resolver supplies the file paths, filter decisions, and resolution results inside the custom panel. No running NovaCart instance or login is required.

OWASP classification note: path traversal is listed under A01:2021 — Broken Access Control rather than A03:2021 Injection because the defect is a missing access check (the server never confirms the resolved file is inside the allowed directory), not a parsing bug in a query language. The root cause — trusting user input without proper validation — and the fix — canonicalize the path fully, then verify containment — follow the same boundary-enforcement pattern you will see throughout the injection lessons. In injection lesson terminology, the sink here is the file-open call that receives the user-supplied path without first confirming the resolved location is within the permitted base directory.

Course position: this is the file-path version of broken access control. You have already seen this boundary-enforcement principle in file-inclusion-lfi-rfi — there the server executes the resolved file; here it only reads it. Later file-upload and Zip Slip lessons apply the same canonicalize-then-verify pattern.

Scope reminder: this lesson sends no file request. Use traversal payloads outside the simulator only in an authorized lab or against a system you are explicitly permitted to test.

When you are ready, send the Continue signal.