File path traversal, traversal sequences stripped non-recursively

Platform: PortSwigger | Category: Directory-traversal | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Directory-traversal

Summary

Walkthrough of the PortSwigger Web Security Academy lab File path traversal, traversal sequences stripped non-recursively (Directory-traversal). This lab demonstrates a directory-traversal vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Directory-traversal

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

When the webpage loads, it loads all the images. The captured request looks like this,

When we give ../etc/passwd , the web application strips the ../ so the user input is interpreted as etc/passwd.

To bypass this we need to give nested traversal sequences like ....//etc/passwd so that even if the server strips ../ so the resulting query which will be processed by the server will be ../etc/passwd.

First we give this i/p - ....//....//etc/passwd

We get this response containing 400 Bad Request.

Next when we try this payload - ....//....//....//etc/passwd , we get the contents of the file.

Key Takeaways / Lessons

• Understanding Directory-traversal detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: File path traversal, traversal sequences stripped non-recursively