File path traversal, validation of file extension with null byte bypass

https://portswigger.net/web-security/file-path-traversal/lab-validate-file-extension-null-byte-bypass

Level: Practitioner

  • In the following challenge if we don't do something we will never get the file.

  • This time we used the simple ../../../etc/passwd.

  • Now we need to bypass the file extension somehow, use a null char %00 followed by .png .

Last updated