File Path Traversal Testing
Warn
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONOBFUSCATIONPRIVILEGE_ESCALATION
Full Analysis
- [DATA_EXFILTRATION]: The skill provides specific methodologies and targets for extracting highly sensitive credentials and system files, including /etc/shadow, /root/.ssh/id_rsa, Windows SAM files, and web application configuration files like wp-config.php.
- [REMOTE_CODE_EXECUTION]: Outlines procedures for achieving remote code execution on a target system through techniques like log poisoning (injecting PHP into Apache or SSH access logs) and abusing PHP wrappers such as data://, expect://, and php://input.
- [COMMAND_EXECUTION]: Includes ready-to-use commands for automated fuzzing and exploitation using external tools such as curl, ffuf, and wfuzz against remote targets.
- [OBFUSCATION]: Details various encoding methods including double URL encoding (%252f), Unicode variations (%c0%af), and null byte injection (%00) specifically designed to bypass web application firewalls (WAFs) and input filters.
- [PRIVILEGE_ESCALATION]: The testing methodologies target files accessible only to high-privilege users (e.g., /etc/shadow or root SSH keys) as a direct means of elevating access on the compromised target system.
Audit Metadata