File path traversal, validation of start of path

Platform: PortSwigger | Category: Directory-traversal | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Directory-traversal

Summary

Walkthrough of the PortSwigger Web Security Academy lab File path traversal, validation of start of path (Directory-traversal). This lab demonstrates a directory-traversal vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Directory-traversal

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

If an application requires that the user-supplied filename must start with the expected base folder, such as /var/www/images, then it might be possible to include the required base folder followed by suitable traversal sequences.

For example:

 bash read-only • copy allowed Copy
filename=/var/www/images/../../../etc/passwd

In this lab, the website loads serveral images just like the previous labs, the request captured looks like this

When we just give ../../../etc/passwd payload in the filename= parameter , we get a 400 Bad Reques in return. This is because the server expects the filename must start with an expected base folder which is /var/www/images.

So , we need to send a payload to retreive the /etc/passwd file where the payload starts with /var/www/images.

When we give /var/www/images/../../../etc/passwd as payload to filename parameter we can retreive the contents of the file.

Key Takeaways / Lessons

• Understanding Directory-traversal detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: File path traversal, validation of start of path