<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div>Yes, I certainly confused the two. What exactly does the "/../" syntax<br>do, and why does it matter to the host? (The article you link isn't<br>explicit enough for me to follow.)<br><br>Nicholas<br>-- <br>Contact and PGP key here <<a href="http://www.ernest.net/contact/index.htm">http://www.ernest.net/contact/index.htm</a>><br><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" color="#144FAE"><br></font></font></div></blockquote><br></div><div>Consider that the url <a href="http://example.com/stuff/morestuff/">http://example.com/stuff/morestuff/</a> pointed to the location /var/www/example.com/public/stuff/morestuff/ on a server. Doing a directory traversal on the url (such as: <a href="http://example.com/stuff/morestuff/">http://example.com/stuff/morestuff/</a>../../../ ) would (on some insecure servers) get the location /var/www/example.com/. Now we know from the previous location that the directory 'public' is contained here, but so could some other directories, such as 'logs' or even important private information.</div><div><br></div><div>As you can see, this would matter to the host, since a lot of webservers are configured to display the contents of directories when they do not come across a specified index file (such as index.html or index.php). If you have a folder that is meant to be publicly accessible, you do not want people to be able to traverse out of that directory and into one that contains private data.</div><div><br></div><div>-Adrian</div></body></html>