File Path Traversal Testing
Warn
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFEOBFUSCATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides explicit methodologies for escalating Local File Inclusion (LFI) to Remote Code Execution. These include log poisoning techniques (injecting PHP code into Apache/SSH logs) and using PHP wrappers like
php://inputordata://to execute arbitrary system commands viacurl. - [COMMAND_EXECUTION]: Contains numerous command-line templates for
curl,ffuf, andwfuzzdesigned to probe for vulnerabilities and execute exploitation payloads against targets. - [DATA_EXFILTRATION]: Specifically targets sensitive system files intended for exfiltration, including Linux shadow files (
/etc/shadow), SSH private keys (id_rsa), environment variables (/proc/self/environ), and Windows SAM databases. - [CREDENTIALS_UNSAFE]: Instructs the agent/user to harvest credentials from configuration files such as
wp-config.php,web.config, and database configuration files, as well as accessing password hashes and private keys. - [OBFUSCATION]: Details various techniques to bypass security filters and Web Application Firewalls (WAFs) using URL encoding (
%2e%2e%2f), double encoding, Unicode/UTF-8 overlong sequences (%c0%af), and null byte injection (%00) to hide malicious file paths.
Audit Metadata