Lab Info

🔐 Vulnerability:

This lab contains a path traversal vulnerability in the display of product images.

⚠️ The application blocks traversal sequences like ../

However, it treats the supplied filename as relative to a default working directory.

🎯 Goal

Retrieve the contents of the file:

/etc/passwd

🪜 Steps to Solve

1. 🔍 The lab contains a directory traversal vulnerability, but…
2. 🚫 It blocks the traditional traversal characters (../).
3. 💡 Instead, we provide the absolute path directly.

🧪 Final Payload

<https://0a0000dd04bcfab0830f0501000c0070.web-security-academy.net/image?filename=/etc/passwd>

🛠️ Interception & Execution

📡 Use Burp Suite to intercept the request.

✍️ Modify the filename parameter in the intercepted request and send it.

📄 The contents of /etc/passwd will be displayed