Path Traversal Defense Lab

This simulator turns a classic secure-coding bug — path (directory) traversal — into a walkable 3D building. Each floor is one directory level; the green floor is the application's sandbox root. Send a request path containing ../ segments and a walker climbs or descends floor by floor exactly the way the server's path-resolution logic would. In "naive concatenation" mode the walker is free to wander below the root into the red danger zone and the request still comes back 200 OK — a real information-disclosure bug. Flip to "canonicalize + prefix-check" and the identical request is stopped the instant it would cross the root boundary, with a 403 response. Live readouts track the resolved depth, how many .. segments were used, and a running count of breaches vs. blocked attempts.