Path Traversal URL Injection via url=/path= Parameters with Large Response

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects potential path traversal attempts in web server and gateway logs, specifically targeting URL parameters like 'url' or 'path'. The rule identifies suspicious URI sequences (e.g., dot-dot-slash) followed by large HTTP responses, which may indicate successful file retrieval or sensitive data access.