The application lets users request files from the server (usually images or documents) using a URL parameter.
Example:
/image?filename=cat.jpg
On the server side, it might map to something like:
/var/www/images/cat.jpg
⚠️ The Vulnerability
The app does not properly validate user input.
That means you can manipulate the file path using:
../
This allows you to move outside the intended directory.
🚀 Exploitation (Simple Case)
Instead of requesting a normal file, you send:
/image?filename=../../../etc/passwd
What happens:
../ moves up one directory
Repeating it escapes the restricted folder
You reach the root directory
Then access a sensitive file like:
/etc/passwd
🎯 Lab Goal
Retrieve the contents of:
/etc/passwd
