thelightfinder

Link to Lab 6 To solve this lab, we need to bypass the application's check for file type extension and exploit the directory traversal vulnerability in the image display endpoint. Check whether the application filters our input: Response from Server: The server doesn't recognize the file, let's try bypassing with null byte: Response from Server: Lab Solved!

Lab 6 Link To solve this lab we need to exploit path traversal vulnerability in the image display endpoint, the application validates the supplied path starts with the expected folder. Let's test the application behavior: Server Response: Nothing is blocked so we exploit the application using this request: Response from Server: Lab Solved!

Link to Lab 4 This Lab has a path traversal vulnerability in the image display endpoint, it attempts to defeat exploitation by stripping the path traversal sequence from the user input before decoding and using the input. The task is to read /etc/passwd  file. As usual, test with normal exploit: Response from Server: The server responded with the image, we can confirm that the input is being stripped. Let's try encoding our input be before sending to the server and hopefully the server will decode it for us: Server Response: The server disagrees, let try doubly encoding the input: Server Response: Lab Solved!

Link to Lab 3   In this Lab, the Task is to retrieve the content of the /etc/passwd  by exploiting path traversal vulnerability in the product display image endpoint. The application attempts to block exploitation by stripping path traversal sequences from the input before usage. Attempting to exploit the vulnerability with normal path traversal sequences: The server responded with: We can inference that our path traversal sequences have been stripped, let's test a bypass by doubling the sequences: Server Response: Lab Solved!

Link to Lab 2 This Lab Contains a path traversal vulnerability in the display product image endpoint. The application blocks traversal sequences but treats the supplied filename as being relative to a default working directory. First, we try to exploit this lab using the normal traversal sequences: The server responds with an error showing path traversal is blocked. Let's modify the request with an absolute path: The server responds with: Lab Solved!

Link to Lab1   The task of the Lab is to retrieve the content of /etc/passwd by exploiting a file path vulnerability in the display of product images. The image display endpoint is: To exploit the path traversal vulnerability, we send the following request: The server responds with the following: The /etc/passwd  has been accessed. Lab Solved!

Link to Lab 11 Lab 11 is tagged expert, but it wasn't so difficult, the Lab involves a Front-end server which doesn't support chunked encoding and a Back-end which does, also the Front-end server is serving as web cache for static resources. The task for this Lab is to perform a request smuggling attack to steal other users' API key via web cache deception. Since we already know that we are dealing with a CL-TE server pair and because this Lab is very similar to the previous Lab, I will skip to exploitation. The Endpoint which serves the API key is /my-account so the idea is that when the server processes the normal request, the smuggled request will be left on the back-end socket. When any normal user makes a request for a static resource, their request will get appended to the smuggled request, the Back-end server will then respond with the appropriate response for / my-account endpoint, the Front-end server will cache the response and we can retrieve the user's API k...