OWASP Hunting
Server-Side

Symbolic Link Attacks

Symbolic link attacks exploit race conditions or file extraction to create symlinks that redirect file operations to unintended targets.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

Symbolic link (symlink) attacks occur when an attacker creates or controls a symlink that causes an application to operate on an unintended file. In web applications, this commonly manifests through archive extraction (zip/tar slip) where archive entries contain path traversal sequences or symlinks pointing to sensitive files.

Attack Vectors

  • Archive extraction features (zip, tar, gzip)
  • File import functionality
  • Backup and restore features
  • CMS theme/plugin installation via upload
  • Docker and container image builds

Testing Methodology

  1. Create a zip file containing a symlink pointing to /etc/passwd
  2. Test zip slip: include a file with path ../../etc/cron.d/malicious
  3. Upload the crafted archive and check if symlink is followed
  4. Test for race conditions in temporary file creation

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Zip Slip Payload Paths
../../etc/passwd../../etc/cron.d/backdoor../../var/www/html/shell.php../../../../../etc/shadow
Symlink in Archive
ln -s /etc/passwd link.txt (create symlink, add to zip)

Indicators of Vulnerability

  • Archive extraction results in files outside the intended directory
  • Sensitive file contents accessible after archive extraction
  • Arbitrary file write demonstrated outside extraction directory

Detection Guidance

Validate all extracted file paths during archive extraction. Reject archives containing symlinks or path traversal sequences.

Mitigation & Remediation

  • Validate all extracted paths against the intended destination directory using canonical path resolution
  • Reject archives containing symlinks or path traversal sequences (../)
  • Use secure archive extraction libraries that handle these cases
  • Extract to a temporary isolated directory and validate before use

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)