Path Traversal Playground
A fake "view file" feature that trusts the filename you give it. Climb out of the intended folder with ../ and read files you shouldn't.
Path traversal is what happens when a filename comes from the user and is trusted. Add enough ../ and you climb out of the intended directory into the rest of the filesystem — configuration files, credentials, keys.
How to use it
- Request a file the feature intends you to have.
- Prefix ../ sequences to climb out of the folder.
- Reach a file you were never meant to read.
What to take away
Encoding defeats naive filters
%2e%2e%2f, double encoding and mixed separators all decode to the same climb. Stripping the literal string ../ once is not a defence.
Resolve, then check
The fix is to canonicalise the full path and confirm it still sits inside the permitted directory — not to inspect the raw input.
Frequently asked questions
What files do attackers look for?
/etc/passwd on Linux as a quick proof, then the valuable targets: application configuration, .env files, private keys and cloud credentials.
How is path traversal fixed properly?
Never build a path from user input directly. Map an identifier to a known-safe filename, or canonicalise and verify containment before opening anything.
Where this fits in the course
This security lab pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- SSRF Playground — A "fetch this URL for me" feature with no allowlist. Point it at internal-looking addresses and see what it leaks.
- XXE Playground — An XML upload feature that expands external entities. Smuggle a local file read through a "harmless" XML document.
- Command Injection Sandbox — A "ping this host" tool glues your input into a real shell command. Chain a second command onto the intended one.
- Leaked Secret Hunt — A public GitHub repo dump. Find the hardcoded API key an automated scanner would catch in minutes — before an attacker does.