Injection: Directory traversal¶

Identifier: directory_traversal

Scanner(s) Support¶

Description¶

Directory traversal allows an attacker to manipulate file paths so that theyre able to access files outside the intended directory. It happens when a web application doesnt properly check or sanitize file path inputs, which means an attacker can trick it into revealing sensitive files like configuration or system information. This is dangerous because it can expose details that could be used to further penetrate the system or compromise data. Developers often make the mistake of assuming input is safe, which is why it's important to validate and restrict what file paths can be accessed.

References:

• https://escape.tech/blog/file-inclusion-directory-traversal-graphql/

Configuration¶

Example¶

Example configuration:

---
security_tests:
  directory_traversal:
    assets_allowed:
    - REST
    - GRAPHQL
    - WEBAPP
    skip: false

Reference¶

assets_allowed¶

Type : List[AssetType]*

List of assets that this check will cover.

skip¶

Type : boolean

Skip the test if true.