File Path Traversal Testing
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides examples of using command-line tools like
curl,ffuf, andwfuzzto test web applications for directory traversal vulnerabilities. These are documented as standard security testing methodologies. - [DATA_EXFILTRATION]: The skill lists common sensitive file paths (e.g.,
/etc/passwd,/root/.ssh/id_rsa,C:\windows\system32\config\SAM) that an attacker might target to exfiltrate credentials or system information during a security audit. - [REMOTE_CODE_EXECUTION]: Section 'Phase 8' describes advanced techniques for escalating local file inclusion (LFI) to remote code execution (RCE) via log poisoning and PHP wrappers, providing the necessary
curlcommands and PHP payloads for testing. - [SAFE]: Despite covering offensive security techniques, the skill is structured as a security testing methodology and includes significant content on prevention measures (Phase 10), such as input validation, white-listing, and path canonicalization in PHP and Python.
Audit Metadata