Testing for directory traversal

Directory traversal attacks are attempts to discover or forced browse to unauthorized web pages usually designed for administrators of the application. If an application does not configure the web document root properly and does not include proper authorization checks for each page accessed, a directory traversal vulnerability could exist. In particular situations, such a weakness could lead to system command injection attacks or the ability of an attacker to perform arbitrary code execution.

Getting ready

Using OWASP Mutillidae II as our target application, let's determine whether it contains any directory traversal vulnerabilities.

...