Path traversal and LFI testing
Path traversal (directory traversal / local file inclusion) is when a file-path input isn't confined to its intended directory, letting an attacker walk the filesystem with ../ and read config, source and secrets — or, with LFI, get code executed. Sintropyc tests every input that names a file and proves each finding with the actual file contents it returned.
What an attacker reaches
A traversal that escapes the intended folder turns your server's filesystem into an open book:
- System files (
/etc/passwd) — the classic proof of escape - Your app's
.env, config and source — often the real prize (DB creds, API keys) - Cloud and container secrets, SSH keys, session files
- LFI → RCE — including a log or upload the attacker controls so it executes
Where it hides
Any parameter that becomes a file path: download and export endpoints (?file=), image and avatar loaders, template or language selectors (?lang=), report and attachment fetchers, and archive extraction (zip-slip). Modern frameworks help, but custom file handling and clever encodings still slip through.
Naive filters miss ..%2f, double-encoding, absolute paths and null-byte tricks. Sintropyc tests the bypasses, not just the plain ../.
How Sintropyc tests it
Sintropyc is an autonomous AI penetration testing agent. It signs in as real users across different roles, drives your product the way a customer would, and proves every finding with a working exploit — never a scanner guess. Each finding is checked by a human before it reaches you, comes with the exact fix, and is attacked again after you ship it to confirm it held.
For path traversal, Sintropyc maps every file-naming input, tries traversal sequences and their encoded bypass variants, and confirms escape by returning a file that proves it — a known system file or your own app config — with the request and the bytes it leaked. Destructive or bulk reads are never part of the proof.
What you get
- Every file-path input and download / export flow tested, including encoded bypasses
- Each finding proven with real returned file contents
- LFI-to-execution chains attributed where reachable
- The fix (canonicalize + confine to a base dir, allow-list) and a retest
Common questions
Isn't this old and mostly fixed by frameworks?
Frameworks help for standard routes, but custom download / export handlers, archive extraction and template loaders still ship it regularly — and the impact (reading your .env) is high. It's worth testing.
Will you read sensitive files?
Proof uses the smallest safe evidence — a known non-sensitive file, or the fact that config is reachable — rather than exfiltrating secrets. Full extraction only with your sign-off.
Do you test zip-slip / archive extraction?
Yes — extracting an archive to a path outside the target directory is a common traversal variant and it's in scope.