File Path Traversal, Simple Case Walkthrough (Apprentice)

Learn how attackers exploit missing input validation to traverse directories and read sensitive files from the server using the classic ../ payload in the PortSwigger Web Security Academy.

Path traversal vulnerabilities are one of the most fundamental yet critical web application security issues. They occur when an application constructs file paths using user-supplied input without proper sanitization, allowing attackers to access arbitrary files on the server. Unlike injection attacks that exploit parsing flaws, path traversal abuse the operating system's directory navigation conventions to break out of the intended file scope.

In this walkthrough, we'll solve the File Path Traversal, Simple Case lab from the PortSwigger Web Security Academy. You'll learn how missing input validation on a file-serving endpoint can lead to full disclosure of sensitive system files, understand the security impact, and implement proper server-side defenses.

📌 Lab Information

Difficulty: Apprentice

Category: Path Traversal

Objective: Retrieve the contents of the /etc/passwd file by exploiting a path traversal vulnerability in the product image display feature.

Lab URL: https://portswigger.net/web-security/file-path-traversal/lab-simple

🎯 What You'll Learn

By completing this lab, you'll learn how to:

✅ Identify path traversal vulnerabilities in file-serving endpoints.

✅ Craft directory traversal payloads using ../ sequences.

✅ Use Burp Suite Repeater to manipulate HTTP request parameters.

✅ Understand how missing server-side validation leads to arbitrary file access.

✅ Apply secure coding practices to prevent path traversal attacks.

🔍 Understanding the Vulnerability

Path traversal (also known as directory traversal or dot-dot-slash attack) exploits the way operating systems navigate directory structures using the ../ sequence to move up one directory level.

In this lab, the application has a product image display feature that accepts a filename parameter via the URL query string:

Copy code block

GET /image?filename=37.jpg HTTP/1.1

GET /image?filename=37.jpg HTTP/1.1

The server reads the file corresponding to the provided filename and returns its contents. The problem? There is no validation on what the user supplies. An attacker can inject ../ sequences to traverse up the directory tree and access any file readable by the web server process.

The vulnerable parameter is:

Copy code block

filename

filename