What problem does it solve? Authorized penetration testers need a systematic way to verify whether web applications properly validate file path parameters, since directory traversal flaws can expose sensitive server files like /etc/passwd, configuration files, and SSH keys. ## Core Features & Use Cases - Traversal Payload Testing: Injects plain, URL-encoded, double-encoded, UTF-8 overlong, and null-byte traversal sequences into file parameters to detect filter bypasses. - LFI and Wrapper Exploitation Checks: Tests PHP wrappers such as php://filter, php://input, data://, and expect:// to assess local file inclusion escalation paths. - Automated Detection Script: The included Python agent auto-detects file parameters in a URL, runs payload suites, matches Linux/Windows file-content indicators, and generates a severity-rated report. - Use Case: During an authorized assessment of a document download endpoint like /download?file=report.pdf, run the agent to confirm whether ../../../etc/passwd or encoded variants return server file contents, then document the finding with reproduction steps and remediation guidance. ## Quick Start Run the agent script against an authorized target URL with a file parameter, for example by asking the AI to test 'http://target/view?file=report.pdf' for directory traversal vulnerabilities.
