PortSwiggerlabs: File path traversal, traversal sequences blocked with absolute path bypass

Scenario :

This lab contains a path traversal vulnerability in the display of product images.

The application blocks traversal sequences but treats the supplied filename as being relative to a default working directory.

To solve the lab, retrieve the contents of the /etc/passwd file.

Scenario :

First we navigate the application like a normal user as usual , from there we check Burp’s History :

We find 2 parameters , one for the Product ID and the other one is for the pictures used for each product, to save time : I already tested PoductID with multiple Payloads from payload all the Things :

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/File%20Inclusion/README.md

But it wasn’t vulnerable :

Now let’s test Filename :

I kept getting No such file , whenever i tried an LFI Paylaod . I even tried multiple filter Bypasses but that didn’t work .

Since it’s saying No Such File , this made me think , maybe if we give the file name , it might find it , instead of having to go back to the root folder .

Maybe /etc/passwd does exist , but ../../../etc/passwd doesn’t since it takes it as an entire string .

That worked , and now if we go back to our Lab , it should say Solved .

That was all for this challenge , see you in the next one :)