Web Security Day 1: PortSwigger Writeup — File Path Traversal (Simple Case)
Hello everyone! As part of my journey diving into Web Security, I’ve started regularly working on labs from the PortSwigger Web Security Academy. In this inaugural article, I’ll share a writeup on solving the File Path Traversal, simple case lab.
What is Path Traversal?
Path Traversal (or Directory Traversal) is a web security vulnerability that allows an attacker to read arbitrary files outside the folder that should be publicly accessible. This occurs when an application uses user input to load a file path without adequate validation. An attacker can inject specific characters (such as ../) to break out of the web application's root directory and access operating system files, credentials, or application source code.
Lab Objective
The goal of this lab is to exploit a path traversal vulnerability in the image display functionality to read the contents of the /etc/passwd system file on the server.
Exploitation Steps
- Finding the Entry Point
When first accessing the main lab page, I noticed that the website loads a large catalog of product images. I opened Burp Suite and used its built-in browser to intercept and analyze the network traffic.
In the Proxy > HTTP history tab, I found a request pattern that loads an image using a URL parameter:
This filename parameter becomes the primary target as it is potentially vulnerable to file path manipulation.
Get Yudha Pratama’s stories in your inbox
Join Medium for free to get updates from this writer.
2. Modifying the Parameter (Exploitation)
I sent the image request to the Repeater (Ctrl + R) so it could be easily modified and re-sent.
Since the target server is believed to be Linux-based, the most common indicator of a successful exploitation is the ability to read the /etc/passwd file. In the request panel, I changed the parameter value from the image filename to the directory manipulation payload:
The ../../../ sequence is used to navigate up a few levels from the image directory to the server root, and then back down into the /etc/ folder.
3. Analyzing the Server Response After clicking the Send button, the server responded with a 200 OK status. Looking at the response body, the image content disappeared and was replaced by system configuration text. The /etc/passwd file was successfully exposed in its entirety, displaying lines of user accounts on the server.
With the successful retrieval of this system file content, the lab is automatically marked as Solved.
How to Prevent This Vulnerability
For developers, path traversal vulnerabilities can be prevented through layered security implementation:
- Avoid Direct User Input: Never pass user-supplied input directly to filesystem APIs. Use database mapping with numerical identifiers or unique hashes instead.
- Canonicalize File Paths: If the application must handle filenames from the user, ensure the name is converted to a canonicalized absolute path, and then verify that the final path strictly resides within the permitted storage directory (e.g., using the
realpath()function and checking the parent directory). - Implement an Allowlist: Reject dangerous characters such as
/,\, and., and only allow specific alphanumeric characters for filenames.
I hope this writeup is helpful for those who are also learning the fundamentals of web security. Stay tuned to my cybersecurity journal for more vulnerability explorations!
