PortSwiggerlabs: File path traversal, traversal sequences stripped non-recursively

Scenario :

This lab contains a path traversal vulnerability in the display of product images.

The application strips path traversal sequences from the user-supplied filename before using it.

To solve the lab, retrieve the contents of the /etc/passwd file.

Solution :

Just like every time , we first start by navigating the application just like a normal user , from there we check Burp History :

We find 2 interesting parameters , Product ID and Filename .

To save time , the ID parameter isn’t vulnerable , i tried multiple payloads , multiple obfuscation methods and Filter Bypasses but they didn’t work .

Now let’s test the Filename parameter using the payloads from payloadallthethings :

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/File%20Inclusion/README.md

Injecting a simple Payload just returns no such file .

I decided to specify the filename instead without any backslashes .

Didn’t work either , maybe the ../ gets flagged by the Firewall or it gets truncated automatically .

Let’s try other Payloads to Bypass the WAF , here are some examples :

%252e%252e%252fetc%252fpasswd
%252e%252e%252fetc%252fpasswd%00
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd%00
....//....//....//etc/passwd
..///////..////..//////etc/passwd
/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd

At the end this one worked :

....//....//....//etc/passwd

You can of course automate this by using Intruder or FFUF , but since there weren’t too many , it was easier to test them manually .

Now if we go back to our Lab , it should say Solved .

That was all for this lab , see you in the next one :)