How to Find Path Traversal and LFI Bugs in Web Apps
Path traversal (and related LFI — local file inclusion) happens when user input influences a file path the server reads.
If ../ sequences are not blocked correctly, you may read files outside the intended directory.
Quick takeaway: Find file/path parameters → try traversal sequences and encodings → prove a non-sensitive file read first → escalate carefully if inclusion executes code.
Where it shows up
file=,page=,template=,lang=,doc=,download=- Image resize paths
- Log viewers
- “Include template” features
- Backup/export downloaders
Testing that stays calm
1) Learn the intended file
Request a normal document and note the response.
2) Traverse one step at a time
Classic ../ style probes belong in labs first. On live targets, prefer reading a known harmless file the program expects you to use as proof.
3) Watch for filters
Apps may strip ../ once. Nested or encoded variants appear in training materials — use judgment and program rules.
4) Distinguish read vs execute
Reading /etc/passwd (where allowed) proves traversal. Including a file into code execution context is a different, usually higher, impact class.
Report tips
- Exact parameter and final path logic
- Proof file contents (minimal)
- Whether the bug is read-only traversal or inclusion
- Fix: canonical path checks, allowlists, no user-controlled paths
Original Bugflare article. Practice with PortSwigger path traversal labs before production testing.