SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-path-traversal

Using sequences like ../ to reach files outside a web application's folder is called what?

Directory traversal, climbing out of the web root with dot-dot-slash.

Start playing free

  1. Buffer overflow
  2. Directory (path) traversal ✔
  3. Credential stuffing

Why: The attacker manipulates file path variables to read files the app never meant to share, such as configuration files or source code.

Huh, didn't know that: OWASP says path traversal can reach application source code, configuration and critical system files.

The dad joke
A hacker walked up the directory tree and said, I'm just going to take the long way home.
Like this card?
Play the game

References

Answer: Directory (path) traversal. The attacker manipulates file path variables to read files the app never meant to share, such as configuration files or source code.

  1. OWASP, Path Traversal owasp.org/www-community/attacks/Path_Traversal
    aims to access files and directories that are stored outside the web root folder
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich web attack inserts a database query into an input field that the application then runs?Security & PrivacyWhich web attack injects malicious scripts into otherwise trusted websites so they run in other users' browsers?Security & PrivacyWhich attack forces a logged-in user's browser to perform an action they did not intend?

That's stuff everyone should know.