| Purpose: Path Traverser is a tool for security testing of web applications.
Path Traverser simulates a real Path Traversal attack, only with actual existing files
It operates as a middleman between the web application to its host server, which gives the abillity to test the actual files as found in the host server against the application, according to their relevant path.
After you have provided the relevant details, Path Traverser will connect (sFTP/SSH) to your host server in order to pull out the list of files.
Then, it manipulates the list taken from the file system so it will fit the web application by changing their paths.
If your application could be found at: http://mysrvr:777/home
and the application files could be found in the file system under: myapps/demoapp/client/version/lastversion/, requests for files under: /myapps/demoapp/client/version/1.1/ will be created as: http://mysrvr:777/home/../1.1/ and requests for files under: /myapp/differentapp/files/ will be created as: http://mysrvr:777/home/../../../../differentapp/files/ , etc...
After that, the Path Traverser will start sending these requests one by one and log the results by the HTTP Response code selected.
A configuration for excluding/including specific file types is available.
| 
