Directory Traversal & Sensitive File Scanner

Search for exposed .git directories, backup files (.bak, .sql), source maps, and server configuration dumps.

Technical Scope & Verification Behavior

Requests common misconfigured paths (/.git/config, /.env, /docker-compose.yml, /package.json, /wp-config.php) to spot file leaks.

Automated Inspection Checks (24)

Passive URL parameter fuzzing

Non-destructive boundary tests

Header & cookie flag assertions

Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

GET /.git/HEAD (returns ref: refs/heads/main)

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)

Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

Nginx Block Hidden Files

patch.diff (nginx)

--- a/handler.nginx (Vulnerable)

# No hidden files block

+++ b/handler.nginx (Remediated)

location ~ /\.(?!well-known).* {
    deny all;
    access_log off;
    return 404;
}

Configure your reverse proxy to block all HTTP requests targeting hidden dot-files and directories.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Add a location block to Nginx or Cloudflare WAF rule blocking all requests starting with /. to prevent leaking Git and env files."

Run Isolated Check

Test your public domain specifically for Directory Traversal & Sensitive File Scanner.

100% passive • No server load

Specification Details

CVSS Score: 8.0 / 10.0
Severity Level: HIGH
Category: VULNERABILITY
Test Vectors: 24 automated
Execution SLA: < 2.5 seconds
False Positive Defense: Strict assertion

Related Standards

#Information Disclosure#Git#Files

Frequently Audited Together

Checks commonly evaluated alongside Directory Traversal & Sensitive File Scanner during surface discovery.

View all 41 checks →

VULNERABILITY

SQL Injection Scanner

Detect SQL injection vulnerabilities in your web application before attackers exploit database access.

CVSS 9.8

VULNERABILITY

Cross-Site Scripting (XSS) Scanner

Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.

CVSS 8.2

VULNERABILITY

API Key Exposure Scanner

Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.

CVSS 9.4

Run continuous monitoring for Directory Traversal & Sensitive File Scanner

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog