dotdotpwn

Name: dotdotpwn
Availability: InStock
Author: Dave

Fuzz directory traversal and LFI vulnerabilities across HTTP, FTP, and TFTP services.

15|1|Updated Feb 12, 2026

Search Tags:#security #vulnerability #web application #fuzzing #lfi #path traversal

Ready to run

npx skills add https://github.com/AeonDave/malskill --skill dotdotpwn

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dotdotpwn
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/web-app/dotdotpwn
Command: npx skills add https://github.com/AeonDave/malskill --skill dotdotpwn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps identify and test for directory traversal vulnerabilities in web applications and services, a common security flaw that can expose sensitive files.

Core Features & Use Cases

Directory Traversal Fuzzing: Automatically tests for path traversal and Local File Inclusion (LFI) vulnerabilities.
Multi-Protocol Support: Works with HTTP, FTP, and TFTP services.
Use Case: When performing a security audit on a web server, use this Skill to check if an attacker can access files outside the intended web root, such as /etc/passwd.

Quick Start

Use the dotdotpwn skill to fuzz the target website example.com on port 80 for directory traversal vulnerabilities.

Frequently Asked Questions about dotdotpwn

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I fuzz a web application for path traversal vulnerabilities?▼

This Skill performs directory traversal fuzzing against web servers and applications to identify path traversal and LFI vulnerabilities. It automatically tests targets to see if attackers can access sensitive files like /etc/passwd outside the intended web root.

Does directory traversal fuzzing work on FTP and TFTP services or only HTTP?▼

Directory traversal fuzzing supports HTTP, FTP, and TFTP services. This allows you to test multiple protocols for Local File Inclusion (LFI) and path traversal vulnerabilities across different network services during a security audit.

What is Local File Inclusion (LFI) testing and when do I need it?▼

Local File Inclusion (LFI) testing checks whether a web application can be tricked into exposing sensitive server files. You need it during security audits to ensure attackers cannot access files outside the intended web root, such as /etc/passwd.

Do I need Perl installed to test for path traversal vulnerabilities on macOS or Linux?▼

Yes, you need Perl installed on your Linux or macOS system to use this fuzzing tool. The Skill requires compatibility with Perl and the apt installation of the dotdotpwn utility to perform directory traversal tests.

Are there limitations when fuzzing for directory traversal vulnerabilities on custom web servers?▼

This fuzzing approach targets path traversal and LFI vulnerabilities across HTTP, FTP, and TFTP services. It is designed for standard security audits on web servers and applications, but may have limitations with highly customized non-standard implementations.