PortSwigger File Path Traversal Lab Solution, Simple Case

In this article, we'll solve the File Path Traversal, simple case lab from PortSwigger's Web Security Academy.

The objective of this lab is to retrieve the contents of the Linux /etc/passwd file by exploiting a Path Traversal vulnerability in the application's product image functionality.

If you're learning web application security, ethical hacking, penetration testing, or bug bounty hunting, this is a great beginner-friendly lab for understanding how Path Traversal works.

What Is Path Traversal?

Path Traversal, also known as Directory Traversal, is a web vulnerability that allows an attacker to access files or directories outside the location that an application intended them to access.

This vulnerability usually occurs when an application accepts a filename or file path from a user without properly validating or restricting it.

For example, imagine a website that allows users to access an image from a specific directory:

/images/profile.jpg

If the application does not properly validate the filename, an attacker may attempt to manipulate the path and navigate outside the intended directory.

The ../ sequence is used to move up one directory in a file system.

By using multiple directory traversal sequences, an attacker may be able to escape the intended directory and access files elsewhere on the server.

One commonly demonstrated target on Linux systems is the /etc/passwd file, which contains information about local system accounts.

Solving the PortSwigger Lab

Now that we understand the vulnerability, let's solve the lab step by step.

Step 1 — Access the Lab

First, open the File Path Traversal, simple case lab in PortSwigger's Web Security Academy.

The lab description tells us that the application contains a Path Traversal vulnerability in the way it displays product images.

It also gives us the objective: retrieve the contents of the /etc/passwd file.

Click Access the Lab to launch the vulnerable application.

Step 2 — Explore the Web Application

After accessing the lab, a simple dummy shopping website will open.

The page contains several product images.

At this point, there is nothing particularly suspicious about the page. Our goal is to find out how the application loads these images.

Step 3 — Open a Product Image

Right-click on any product image and select:

Open Image in New Tab

This opens the image directly in the browser.

When the image opens in a new tab, look at the URL in the browser's address bar.

You should notice that the application uses a filename parameter to determine which image should be displayed.

For example, the parameter contains the name of the image file currently being requested.

This is interesting because the filename is being supplied through the request.

Whenever we see an application accepting a file path or filename from the user, it is worth checking whether that input is properly restricted.

Step 4 — Test for Path Traversal

Now we can test whether the filename parameter is vulnerable to Path Traversal.

Instead of requesting the original image, modify the filename parameter so that it attempts to navigate outside the intended image directory and access the target Linux file.

The exact modification is shown in the screenshot below.

The important concept here is the use of directory traversal sequences to move upward through the directory structure.

We are essentially telling the application:

"Instead of retrieving the image from the expected directory, try navigating outside that directory and retrieve the target file."

Step 5 — Observe the Response

After loading the modified request, the browser displays an error indicating that the image cannot be displayed because it contains errors.

At first, this may look like the request failed.

However, the error makes sense.

The application is normally expected to return an image, while the file we requested is a text file.

Therefore, the browser cannot render the response as an image.

The important part is that the application processed our manipulated file path rather than restricting the request to the intended image directory.

This confirms the Path Traversal vulnerability.

Lab Solved!

After the request is processed, PortSwigger confirms that the lab has been successfully completed.

The lab displays:

"Congratulations, you solved the lab!"

🎉 The File Path Traversal lab is solved!

Why Did This Work?

The application was designed to retrieve product images based on a filename supplied by the user.

Normally, the application expects something like an image filename.

However, because the application does not properly restrict the supplied path, we can manipulate the filename to navigate outside the intended directory.

The directory traversal sequence allows us to move up through the file system and eventually reach a file that the application should not have allowed us to access.

In this lab, the target was the Linux /etc/passwd file.

The vulnerability can therefore be summarized as:

User-controlled filename → insufficient path validation → directory traversal → unauthorized file access

Key Takeaway

The main lesson from this lab is simple:

Never trust user-controlled file paths.

If an application allows users to specify filenames or paths, it should properly validate and restrict those values.

A secure application should ensure that users can only access files from the directories they are actually authorized to access.

Path Traversal vulnerabilities can potentially expose sensitive files such as configuration files, application source code, credentials, or other information stored on the server.

Conclusion

The File Path Traversal, simple case lab is a straightforward introduction to one of the fundamental vulnerabilities in web application security.

The vulnerability existed because the application trusted a user-controlled filename without properly restricting where that file could be accessed from.

By manipulating the filename and using directory traversal, we were able to access a file outside the application's intended directory and successfully complete the lab.

If you're currently working through the PortSwigger Web Security Academy, this is an excellent lab for building a foundation in server-side vulnerabilities.

More PortSwigger lab solutions, web security concepts, and cybersecurity walkthroughs coming soon.

Happy hacking! 🚀