File Path Traversal: Simple Case

Lab#

File path traversal, simple case · Apprentice

Solution#

Given#

This lab contains a path traversal vulnerability in the display of product images.
To solve the lab, retrieve the contents of the /etc/passwd file.

Analysis#

Somewhere on the site there's a path traversal vulnerability in product image display. We need to read the /etc/passwd file using it.

Recon#

We look at the site, paying attention to image-loading requests. We set up a filter to show such requests. We see the request:

GET /image?filename=60.jpg

We send it to Repeater and try path traversal.

First we try ../../etc/passwd — "No such file".

Final payload#

GET /image?filename=../../../etc/passwd HTTP/2

Lab solved!