On this page
apsyleg1 min read
#portswigger #path-traversal #web-security
File Path Traversal: Bypassing Extension Validation with a Null Byte
Lab
File path traversal, validation of file extension with null byte bypass · Practitioner
Solution
Given
This lab contains a path traversal vulnerability in the display of product images.
The application validates that the supplied filename ends with the expected file extension.
To solve the lab, retrieve the contents of the /etc/passwd file.
Analysis and recon
Same as the previous lab, except this one validates the file extension, so we can use the "null byte" technique — %00.
Final payload
GET /image?filename=/../../../etc/passwd%00.png
We jumped to root, then cut off the read with a null byte. As a result we read /etc/passwd, and the filter is bypassed.
Lab solved!
More in this category
Arbitrary Object Injection in PHP (PortSwigger Lab)
Recovering leaked source code and injecting a serialized CustomTemplate object whose __destruct deletes an arbitrary file.
Using Application Functionality to Exploit Insecure Deserialization (PortSwigger Lab)
Tampering with the `avatar_link` field in the session object to delete an arbitrary file via the account-delete feature.
Modifying Serialized Data Types (PortSwigger Lab)
Abusing PHP loose comparison by changing the `access_token` type to integer `0` to bypass authentication.