Join us on May 15 for a live demo of how Burp Suite DAST solves real-world security challenges.            Register Now
Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Lab: File path traversal, simple case

APPRENTICE

This lab contains a path traversal vulnerability in the display of product images.

To solve the lab, retrieve the contents of the /etc/passwd file.

ACCESS THE LAB

Solution

  1. Use Burp Suite to intercept and modify a request that fetches a product image.

  2. Modify the filename parameter, giving it the value:

    ../../../etc/passwd
  3. Observe that the response contains the contents of the /etc/passwd file.

Community solutions

Rana Khalil
Intigriti
z3nsh3ll
Michael Sommer

Register for free to track your learning progress

The benefits of working through PortSwigger's Web Security Academy

  • Practise exploiting vulnerabilities on realistic targets.

  • Record your progression from Apprentice to Expert.

  • See where you rank in our Hall of Fame.

Already got an account? Login here

Try Burp Suite for Free

Find path traversal vulnerabilities using Burp Suite

Try for free