off-by-slash
A Burp Suite extension that detects NGINX alias traversal vulnerabilities by analyzing HTTP traffic patterns to identify path traversal misconfigurations.
A Burp Suite extension that detects NGINX alias traversal vulnerabilities by analyzing HTTP traffic patterns to identify path traversal misconfigurations.
Checked October 2026.
off-by-slash is a Burp Suite extension that identifies alias traversal vulnerabilities in NGINX configurations through automated analysis of HTTP requests and responses.
The extension operates by examining web traffic patterns to detect potential path traversal issues that arise from NGINX alias directive misconfigurations. These misconfigurations can allow attackers to access files and directories outside of the intended web root.
The tool integrates directly with Burp Suite's proxy functionality, enabling security professionals to test NGINX configurations at scale during web application assessments. It analyzes server responses to identify indicators of successful alias traversal attempts.
The extension focuses specifically on NGINX server configurations and their potential security weaknesses related to file path handling and directory access controls.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about off-by-slash: features, pricing and alternatives.
off-by-slash is a product in the Penetration Testing category. It covers Misconfiguration.
off-by-slash is free. Download and setup instructions are at https://github.com/bayotop/off-by-slash/.
Alternatives to off-by-slash listed on CybersecTools:
Compare all off-by-slash alternatives at https://cybersectools.com/alternatives/off-by-slash
off-by-slash is available as on-premises. It is listed for smb, mid-market and enterprise organizations. It is free.
Side by side: features, pricing model and the company behind each one.
A toolkit to attack Office365, including tools for password spraying, password cracking, token manipulation, and exploiting vulnerabilities in Office365 APIs and services.
A reconnaissance tool that retrieves information from Office 365 and Azure Active Directory using a valid credential.
Hashcat is a fast and advanced password recovery utility that supports various attack modes and hashing algorithms, and is open-source and community-driven.
An image with commonly used tools for creating a pentest environment easily and quickly, with detailed instructions for launching in a VPS.
OneGadget is a CTF-focused tool that uses symbolic execution to find RCE gadgets in binaries that can execute shell commands through execve('/bin/sh', NULL, NULL).
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,027 products.
Connect your AI
