PortSwiggerlabs: File path traversal, simple case

Scenario :

This lab contains a path traversal vulnerability in the display of product images.

To solve the lab, retrieve the contents of the /etc/passwd file.

Solution :

This one is pretty straight forward , no sanitization , so it shouldn’t be that complicated .

First we just navigate the application like a normal user , then from there we check Burp’s History to see if we can find anything useful .

A POST Request we can tamper with , a parameter that we can inject whether it be a GET or POST Request , anything that we can use really .

Looking at Burp’s History , we see that we have an id parameter that changes depending on each product we select , this is a Path Traversal labs so the payloads we will use are specific to LFI , but usually whenever we find a parameter , we should test for all type of injections as well , SQLI,XSS,SSTI, …

For now looking at HackerReciepe or payload all the things , we can tets some LFI payloads :

https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion

This didn’t work , i tried multiple Bypasses but didn’t get anything , i assume the ID parameter isn’t the vulnerable one here .

I removed every filter from Burp , to see ALL requests made to the server , and i found this :

The filename is the parameter used to get the images for each Product , let’s test this one , since usually the Images might be stored locally , and maybe by changing the parameter value to another internal file , we might be able to read it .

Worked perfectly , as i said before no sanitization nor blacklist filters are in place .

Now back to our lab , it should be solved .

That was all for this lab , see you in the next one :)