wildhunter logo
The arsenal

Payloads.

Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.

SQL InjectionXSSSSRFCommand InjectionSSTIFile Inclusion (LFI)Path TraversalInsecure DeserializationNoSQL InjectionGraphQLJWTCORSRequest SmugglingOpen RedirectFile UploadIDOROAuthAccount TakeoverRace ConditionCRLF InjectionCSRFLDAP InjectionXXEWeb Cache Deception

Path Traversal

Manipulating file-reference variables with dot-dot-slash sequences to access files and directories outside the intended root. Unlike LFI, this is about reading/serving arbitrary files — downloads, static handlers, archive extraction.

Severity guide

High on proven arbitrary file reads (credentials, configs); medium on file-write primitive; impact scales with what the file system holds.

Where to look

entry points to test first

01

Download endpoints

/download?file=, /attachment?id=, report/image/file serving — the most common traversal home.

02

Static-file routes

/static/..., /assets/... proxies where a filename joins a base directory.

03

ZIP/archive extraction

Zip Slip: entry names with ../ inside archives escape the extraction directory.

04

Filename parameters

Exports, backups, CSV/JSON downloads named by the client.

05

Image/CDN resolvers

Image fetchers that resolve local paths from a name parameter.

How to hunt it

in order, start to finish

  1. Target static-file routes

    /static/, /download?name=, attachment endpoints — anywhere a filename is joined onto a base directory.

  2. Climb with ../

    Enough ../ sequences to reach the root, then /etc/passwd (Linux) or /windows/win.ini (Windows).

  3. Encode around filters

    %2e%2e%2f (single), %252e%252e%252f (double), %c0%ae (overlong), and fullwidth %uff0e%uff0e%u2215 all defeat different validators.

  4. Try backslashes on Windows

    ..\ and mixed ..\/ variants matter on IIS/Windows stacks.

  5. Test Zip Slip on extractors

    Craft an archive whose entry names are ../../shell.php-style and upload it — extraction outside the target directory is the bug.

  6. Automate the climbing

    dotdotpwn handles the fuzzing loop across HTTP/FTP with custom depths.

Filter & validation bypasses

when your first tries get blocked
  • 01../ stripped? ....// re-forms after stripping; ..././ survives single-pass filters.
  • 02Encoded once? Double-encode %252e%252e%252f — some stacks decode twice.
  • 03Byte-level filters? Overlong UTF-8 %c0%ae and fullwidth %uff0e normalize to dots after validation.
  • 04Absolute paths blocked but used anyway? Some servers accept /etc/passwd directly when the param expects a path.

Impact ladder

what makes it payable
  1. 01Arbitrary file read — credentials, configs, /etc/shadow, application secrets.
  2. 02Source-code exposure — read application files off disk.
  3. 03File-write primitive (rare) → webshell placement via Zip Slip.
  4. 04Windows stacks: win.ini access proves it; SAM hive access escalates.

Payloads

7 · from PayloadsAllTheThings
%2e%2e%2f

URL-encoded ../ — the baseline encoded traversal.

%252e%252e%252f

Double-encoded ../ — for servers that decode twice.

%c0%ae%c0%ae%c0%af

Overlong UTF-8 traversal — bypasses byte-level filters.

%uff0e%uff0e%u2215

Fullwidth Unicode ../ — normalization on some stacks re-forms it.

..././

Dot-triple climbing — survives naive ../ stripping.

..\/

Backslash-slash mix for Windows path handling.

{{BaseURL}}/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e/etc/passwd

Nuclei-style template — deep climb to the root canary.

Toolsdotdotpwn/
Full Path Traversal section ↗

Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.

Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.

Payloads — wildhunter