What problem does it solve? Security testers need a disciplined, evidence-gated method to verify whether file download, preview, static proxy, and archive extraction endpoints properly enforce path normalization, root directory, and symlink boundaries—without touching real system or user files. ## Core Features & Use Cases - Single-Variable Differential Testing: Compares one path semantic at a time (relative paths, normalization, parent segments, absolute paths, encoding, controlled symlinks) against a fixed baseline. - Marker-Based Oracle: Uses only self-created marker files with distinct hashes in allowed/ and outside-controlled/ directories, so a finding is valid only when the server returns the controlled marker with matching hash or audit proof. - False-Positive Filtering: Treats 404s, path echoes, stack traces, CDN fallbacks, WAF blocks, and single 2xx responses as INCONCLUSIVE, and routes confirmed issues to hunt-lfi, hunt-file-upload, or hunt-rce. - Use Case: During an authorized web assessment, validate that a file download parameter cannot escape its allowed root by requesting only pre-planted marker files and confirming results via hash comparison and cleanup records. ## Quick Start Use hunt-path-traversal to plan an evidence-gated path traversal validation of the download endpoint using only controlled marker files.
