Documentation
  • 🍻Intro
    • Why API Security is Critical?
    • Pynt at a Glance
    • Who Should Use Pynt?
  • 👩‍💻API Security Testing
    • Security Testing Overview
    • Prerequisites for Running Pynt Scans
    • How to Install Pynt CLI
    • How to install Pynt Binary (Linux only)
    • Pynt CLI Modes
      • 🔵Pynt Command CLI Mode
      • 🔵Pynt Listen CLI Mode
    • Pynt Security Tests Coverage
      • Business Logic Tests
      • Injection Tests
      • Authentication Bypass Tests
      • Mass Assignment Tests
      • Server-Side Request Forgery Tests
      • Stack Trace In Response
      • Lack of Resources and Rate Limiting
      • File Path Manipulation
      • GraphQL Introspection Vulnerability
      • GraphQL Alias Overloading
      • LLM APIs Vulnerabilities
      • Insecure Transport Scheme
      • Basic Authentication
      • HTTP Desynchronization (Desync) Attack
    • Sensitive Data Exposure Detection
    • Pynt Scans Troubleshooting
      • Pynt CLI Troubleshooting
      • Pynt for Postman Troubleshooting
        • Troubleshoot Pynt Container not Running Error
        • Troubleshoot Empty API Key Error
        • Troubleshoot Unauthorized API Key Error
        • Troubleshoot Collection Not Found Error
        • Troubleshoot Non-Unique Collection Name Error
        • Troubleshoot Empty Collection Identifier Error
        • Troubleshoot Unreachable Target Error
        • Troubleshoot Target Responds with Errors Error
        • Troubleshoot Unresolved Target Domain Error
        • Troubleshoot Unresolved Variable Error
        • Troubleshoot TLS Handshake Fail Error
        • Troubleshoot Few Requests Error
        • Troubleshoot One User Only Error
        • Troubleshoot Failed Assertions Error
    • How To
      • How to Run Business Logic Tests with Pynt
      • How to associate a Pynt scan to an Application in Pynt Dashboard
      • How to tag a scan in Pynt
    • Benchmarks
      • Pynt vs OWASP crAPI
  • 🤲Security Testing Integrations
    • 🟠Pynt with API Testing Tools
      • 🔘Pynt for Postman
        • Fork Pynt Collection
        • Run Pynt Container
        • Run Pynt in Postman
        • View Scan Results in Postman
      • 🔘Pynt for Insomnia
      • 🔘Pynt for ReadyAPI
    • 🟠Pynt with API Testing CLIs
      • 🔘Pynt for Newman (Postman CLI)
      • 🔘Pynt for TestRunner (ReadyAPI CLI)
    • 🟠Pynt with Testing Frameworks
      • 🔘Pynt for .NET (xUnit)
      • 🔘Pynt for Selenium
      • 🔘Pynt for Rest Assured
      • 🔘Pynt for Jest
      • 🔘Pynt for pytest
      • 🔘Pynt for Go
      • 🔘Pynt for JMeter
    • 🟠Pynt on CI/CD
      • ❗How to get Pynt ID for CI/CD Authentication
      • 🔘Pynt for GitHub Actions
      • 🔘Pynt for Azure DevOps Pipelines
      • 🔘Pynt for GitLab
      • 🔘Pynt for Jenkins
    • 🟠Pynt with Burp Suite
    • 🟠Pynt with Browsers
      • 🔘Pynt for Firefox Browser
    • 🟠Live Traffic Connectors
      • 🔘eBPF
        • 🔘Key Components
      • 🔘Traffic Mirroring
    • 🟠Advanced Pynt Examples
      • 🔘Pynt as a Standalone Container
      • 🔘Pynt with Prerecorded Har Files
      • 🔘Pynt with cURL
  • 🈸Applications View
    • Application View Overview
    • Manage Applications
      • Add Application
      • Delete Application
      • Rename Application
    • Manage Sources for API Discovery
      • Add Source
      • Delete Source
      • View Source Info
      • Source Categories
        • API Documentation
          • Swagger
          • Postman Collection
        • API Gateways
          • AWS API Gateway
          • Azure API Gateway
          • Kong API Gateway
          • GCP API Gateway
          • Gravitee API Gateway
        • Testing (API Security Scans)
        • Live Traffic
          • Data Collection with eBPF
          • ALB Traffic Capture with AWS Traffic Mirroring
        • Code Repository
    • Application Dashboard
    • Generate Pentest Report
  • 📚API Catalog
    • API Catalog Overview
    • Navigate API Catalog
      • Filtering API Catalog by Application
      • API Catalog Customization
      • API Related Info
      • APIs at Risk
    • Manage API Source Gaps
      • New APIs
      • Untested APIs
      • Shadow APIs
      • Undocumented APIs
    • View Detailed Endpoint Info
  • ⏪Scan History
    • Scan History Overview
    • Navigate Scan History
      • Associating Scans with Specific Application
      • Filtering by Application
      • Scan Related Info
      • Scan History Customization
    • View Detailed Scan Info
    • Associate Vulnerabilities to Tickets with JIRA
  • Account Management
    • Single Sign-On (SSO)
      • Setting up Okta
      • Setting up Entra ID
Powered by GitBook
On this page
  • Introduction
  • What are the common mistakes made by developers?
  • How can I fix file path manipulation issues?
  • Test cases in this category
  1. API Security Testing
  2. Pynt Security Tests Coverage

File Path Manipulation

Explore Pynt's documentation on file path manipulation security tests! Understand how Pynt safeguards against file path vulnerabilities, ensuring robust security for your APIs.

At a Glance: 🗂️ File Path Manipulation occurs when an attacker alters the file path in an API request to access unauthorized files or directories on the server. This vulnerability, often called directory traversal, allows attackers to read, write, or execute files outside the intended directory. To prevent this, always validate and sanitize file paths, ensuring that only authorized files are accessed.


Introduction

File path manipulation (sometimes called LFI - local file inclusion) is a type of security vulnerability that occurs when a cloud application allows an attacker to include files located on the server's local file system. This vulnerability typically arises when the application processes user-supplied input without proper validation or sanitization.

This vulnerability can have serious consequences as it allows an attacker to read sensitive files on the server. Some of the files that may be accessible through this vulnerability include configuration files, sensitive user data, and even system files, depending on the application's configuration and permissions.

What are the common mistakes made by developers?

  1. Insufficient input validation: Failing to properly validate user-supplied input allows attackers to manipulate file paths and inject malicious data that leads to file path attacks.

  2. Using user-controlled input directly: Including user-controlled input, such as file names or paths, directly in file inclusion functions without proper sanitization can enable attacks.

  3. Not using absolute file paths: Relying on relative file paths in file inclusion functions can create vulnerabilities, as attackers may manipulate the relative paths to access unauthorized files.

  4. Allowing directory traversal: Failing to restrict access to specific directories can enable attackers to traverse the directory structure and access sensitive files outside the intended scope.

How can I fix file path manipulation issues?

  1. Input Validation and Sanitization:

    • Always validate and sanitize user input before using it in file inclusion functions. Use whitelisting or regular expressions to ensure that input adheres to expected patterns.

    • Avoid using user-controlled input directly in file paths without proper validation.

  2. Use Absolute File Paths:

    • Instead of relying on relative file paths, use absolute file paths when including files. This ensures that files are loaded from specific, predefined locations and prevents directory traversal attacks.

  3. Implement Access Controls:

    • Enforce access controls to restrict access to sensitive files and directories. Only allow access to files that are essential for the application's functionality and deny access to others.

  4. Disable Remote File Inclusion:

    • If your application doesn't require it, disable the option to include files from remote servers. Remote file inclusion can be a security risk and should be avoided if not necessary.

  5. Secure File Inclusion Functions:

    • If possible, use safer alternatives to file inclusion functions that provide additional security features. For example, some programming languages offer functions that automatically handle input sanitization and file inclusion securely.

Test cases in this category

This test case queries excessive number of elements:

Test case
OWASP
CWE

[FM001] File path manipulation

PreviousLack of Resources and Rate LimitingNextGraphQL Introspection Vulnerability

Last updated 8 months ago

👩‍💻