Creator: Changsha Langhui Information Technology Co., Ltd.
Keywords: ,,,LFI,,RFI,,ATT&CK T1083,,

Dataset Overview

Definition：Path Traversal Detection Rule Datasetis provided byChangsha Langhui Information Technology Co., Ltd.High-quality web safety testing datasets built by security labs. Each piece of data is defined as "XML Rules + PCAP Traffic + HTTP Reconstructed Text + Attack Type Labels + Ground TruthThe five-tier group Link Structures Organization, covering directory travel, local file inclusion (LFI), remote file inclusion (RFI), path-routing bypass, symbol link attack five subtypes, ATT&CK framework T1083 (document and catalogue discovery) and T1005 (local system data) mapping, designed for training of file access security AI detection models.

Dataset Name	Path Traversal Detection Rule Dataset
Total Data Volume	800-20,000 Records
Data Type	Five-member group: XML rule + PCAP flow + HTTP returned text + attack type label + standard answer
Data Source	Langhui Safety Laboratory + Hole Platform Validation Data + OWASP Test Example
License Type	Commercial Licensing Complete authorization documents are attached
Delivery Cycle	2-3 Weeks
	Directory travel, local file containing LFI, remote file containing RFI, path regularization bypass, symbol link attack (Symlink Attack)
ATT&CK Mapping	T1083（File and Directory Discovery）、T1005（Data from Local System）
Output Format	JSONL / CSV / PCAP
Language	Chinese-English Bilingual

Core Data Fields

Each data contains six categories of rule identification, XML detection rules, attack payload, HTTP restore text, PCAP traffic, and standard answers, covering the complete closed loop from rule definition to validation evaluation.

Field Category	Field Count	Typical Fields
Rule Identifier	4	rule_id (only ID of the rules), rule_name (name of the rules), category (type of attack), severity (serious level: CC/High/Medium)
XML Detection Rules	3	rule_xml (ModSecurity/CRS XML rule), description_logic (detection logic), monitoring_patters (regular pattern: ./ / / / )
Attack Payload	4	Payload (attack on Payload), Traversal_depth (crossing depth levels), encoding_type (coding method: URL/Unicode/Double), bypass_technique (twice-back techniques)
HTTP Reconstructed Text	3	http_request (full HTTP request), http_response (full HTTP response), content_ type (response to Content-Type)
PCAP Traffic	4	pcap_file (PCAP file name), pcap_size (file size), packet_count (number of data packets), protocol (transport layer protocol)
Ground Truth	4	is_traversal (for cross-attack: True/false), attack_type (type of attack), target_file (target file name), access_level (access access access)

Data Sample Showcase

The following is a sample structured JSON after de-identification, showing the typical format of SQL injection quintuple detection data.

{
  "entry_id": "PT-2024-001723",
  "rule_id": "PT-DIRTRAV-0056",
  "rule_name": "Directory Traversal via ../ Sequence",
  "category": "Directory Traversal",
  "severity": "Critical",
  "rule_xml": "<rule id=\"930110\" phase=\"2\">\n  <operator>detectPathTraversal</operator>\n  <action>block</action>\n  <pattern>(?:\\.\\.(?:/|%2f|%5c)|%2e%2e(?:/|%2f|%5c))</pattern>\n  <target>ARGS|REQUEST_BODY|REQUEST_HEADERS</target>\n</rule>",
  "payload": "../../../../etc/passwd",
  "traversal_depth": 4,
  "encoding_type": "URL-encoded",
  "bypass_technique": "none",
  "http_request": "GET /download.php?file=..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\r\nHost: vuln-app.com\r\n\r\n",
  "http_response": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon...",
  "pcap_file": "pt_dirtrav_etc_passwd.pcap",
  "pcap_size": "8934",
  "packet_count": 28,
  "technique_id": "T1083",
  "cve_ref": "N/A",
  "answer": {
    "is_traversal": true,
    "attack_type": "Directory Traversal",
    "target_file": "/etc/passwd",
    "access_level": "root_readable"
  }
}

AI Application Scenarios

Path crossing detection model

20,000 paths through the AIT-TRAINS model, automatic catalogue-crossing from the requested path mode, document access attacks such as LFI, RFI, and support for CNN/RNN structures.

WAF Directory Through Commons

The rich code bypasses Payload (URL/Double/Unicode/UTF-8 overlong) and supports training AI model generation against WAF rules, covering all mainstream code bypassing technology.

File Access Control AI

Based on the access_level label in the standard answer, training AI model to build smart file access control systems to detect and deter unauthorized file access behaviour in real time.

Web application firewall training

The cover catalogue goes through the full attack surface through the +LFI+RFI+ path regularization, and the document that trains WAF AI to achieve high accuracy contains leak detection and attack disruption.

Automation of infiltration testing

A rich rounding technique data (Double encoding/Unicode/UTF-8 overlong/null byte/ path cut-off) and training to infiltrate the testing of AIAA automated test files to access gaps.

Sensitive file leak detection

Based on the target file map (passwd/shadow/config/aws_credentials), training AID detection model to identify route-crossing attacks against sensitive system documents.

Frequently asked questions

How are datasets authorized? Can it be used for business AI training?

This dataset is provided byChangsha Langhui Information Technology Co., Ltd.Provide business authorizations to explicitly cover business AI training and safety product development.

Which routes are covered through the type of attack?

Override directory travel, local file contains (LFI), remote file contains (RFI), path-routing bypass, symbol-link attacks five main subtypes.

What's the technique of bypassing?

The bypass technique covers a variety of mainstream techniques, including the Double URL code, Unicode code, UTF-8 overlong code, Null byte cut, path cut, case change, URL secondary decode.

Which sensitive system documents are covered by the target file?

Covers Linux (/etc/passwd,/etc/shadow, ~/.ssh/id_rsa,/proc/self/environ) and Windows (boot.ini, SAM, Web.config, applicationhost.config) two platforms.

How do you obtain data or business advice?

This dataset is provided byChangsha Langhui Information Technology Co., Ltd.The DataAssetsAPI platform is operational under the flag. Supports standard data sets and customizes both models as needed.

Need customised paths across detection data programs?

Changsha Langhui Information Technology Co., Ltd. The DataAssetsAPI platform is dedicated to providing high-quality, compliant web security data assets for AI companies and research institutions. Supports flexible combinations by SQL injection subtype, by database platform, and by detection rule format.

Data sample previews Customisation Path Crossing Programs Professional technical support

Data Sample Preview Customized Discipline-Specific Solutions Professional Technical Support