CSPT

Client Side Path Traversal

Detection

• Look for file parameters in URLs:

  Copy

  https://example.com/getFile?path=/user/docs/report.pdf

• Check if JavaScript fetches files:

  Copy

  fetch("/api/getFile?name=report.pdf")

Exploitation

https://app.example.com/delete-session?session=../profile

The resulting DELETE request would target /api/users/profile instead of /api/users/sessions/${sessionId}.

Path Traversal Vulnerabilities In Client SideDeepStrike

CSPT2CSRF

Exploiting Client-Side Path Traversal to Perform Cross-Site Request Forgery - Introducing CSPT2CSRF · Doyensec's Blog

Burp Extension

Client-Site Path Traversal Exploitation

Client-Side Path Traversal | VeryLazyTech

GitHub - doyensec/CSPTBurpExtension: CSPT is an open-source Burp Suite extension to find and exploit Client-Side Path Traversal.GitHub