Triggering Full Path Disclosure - The Basics

2021-07-25 // Part 1

Full path disclosure (FPD) reveals the absolute filesystem path of web application files. On its own, it is low severity. Combined with other vulnerabilities - local file inclusion, SQL injection with file read, directory traversal - knowing the exact path makes exploitation reliable instead of guesswork.

This is Part 1 covering the basics. Part 2 will cover extracting information from stack traces.

Why paths matter

If you find an LFI vulnerability, you need a path to include. Guessing /var/www/html/config.php works sometimes. But the application might live at /opt/webapp/releases/v2.3.1/public/config.php. Without FPD, you are blind.

Same with SQL injection - LOAD_FILE() and INTO OUTFILE need absolute paths. FPD gives you exactly that.

Triggering PHP errors

PHP is the easiest target. When display_errors is enabled (common in development, disturbingly common in production), invalid input triggers verbose error messages:

# Send an array where a string is expected
https://target.com/index.php?id[]=1

# Response:
# Warning: mysqli_query() expects parameter 1 to be string,
# array given in /var/www/target.com/includes/db.php on line 42

Other PHP error triggers:

# Null byte (legacy PHP < 5.3.4)
https://target.com/index.php?page=about%00

# Excessively long parameter
https://target.com/index.php?id=AAAA....(5000 chars)

# Invalid UTF-8 sequences
https://target.com/index.php?name=%c0%ae

Accessing known files

Certain files reliably disclose path information when accessed directly:

# phpinfo() - often left accessible
https://target.com/phpinfo.php
https://target.com/info.php
https://target.com/test.php

# Look for DOCUMENT_ROOT, SCRIPT_FILENAME, include_path

# Common debug/status endpoints
https://target.com/server-status    # Apache mod_status
https://target.com/server-info      # Apache mod_info
https://target.com/debug/vars       # Go applications
https://target.com/actuator/env     # Spring Boot

Request manipulation

Send requests the application does not expect:

Wrong HTTP method - send POST to a GET endpoint, or PUT/DELETE/PATCH
Invalid Content-Type - send application/xml to an endpoint expecting JSON
Missing required parameters - omit fields the backend assumes exist
Non-existent routes - request paths that do not map to controllers

Framework error pages are goldmines. Django's debug mode shows the full traceback with paths. Laravel's Whoops page includes the entire stack. Rails shows the application root.

Automated discovery

Combine with directory brute-forcing. Many scanners flag FPD automatically, but manual testing catches cases they miss - especially when the disclosure requires specific parameter manipulation rather than just hitting a URL.

Part 2 will cover reading stack traces to map the application structure and identify additional attack surface.