Тестирование обхода файловых путей в веб-приложениях

★ 6.6 · security

file-path-traversal is a Claude Code skill that delivers a comprehensive methodology for testing and exploiting directory traversal (LFI) vulnerabilities in web applications. It covers the full attack workflow: mapping vulnerable parameters such as ?file=, ?path=, ?template=, and ?include=; basic traversal with ../ chains on both Linux and Windows; and filter bypass techniques including double URL encoding, nested sequences, null-byte injection, and Unicode overlong encoding. The skill also catalogs high-value target files — /etc/passwd, SSH private keys, web server configs, and Windows SAM files — and assumes tooling with Burp Suite, OWASP ZAP, cURL, and fuzzers like ffuf or wfuzz. Outputs include a vulnerability report, exploitation proof with extracted file contents, impact assessment, and secure-coding remediation guidance, making it a practical resource for penetration testers and web application security professionals.