Core Idea
The application still reads files using a user-controlled parameter (like filename), but this time it tries to block classic traversal payloads such as:
../
So a normal attack like:
../../../etc/passwd
will not work because the server filters or removes ../.
The Vulnerability
The defense is incomplete.
It blocks traversal sequences, but does not prevent absolute paths.
This means the application might still accept a full path starting from the root directory.
Exploitation (Bypass)
Instead of using traversal sequences, you directly provide an absolute path:
/image?filename=/etc/passwd
What happens:
The server skips traversal checks (since no ../)
It directly accesses the file from the root
Returns sensitive file content
Lab Goal
Access and read:
/etc/passwd
If the response shows its contents, the lab is solved.
Why the Defense Fails
It focuses only on blocking ../
It ignores other ways to control paths
No proper validation or restriction to a safe directory (like allowlisting)
Key Takeaway
Blocking specific patterns (like ../) is not enough.
Secure implementations must:
Restrict access to a fixed directory
Validate input strictly
Normalize paths before use
Otherwise, attackers can bypass filters using alternative techniques like absolute paths.
