Lab · Easy-Intermediate · 15 min Solved
Path traversal
A file viewer joins paths unsafely. Climb out of public/ with ../ in a fake file system.
1) The idea
If the server glues your file name onto a folder path, ../ can walk upward into other folders.
2) Try it
Open a path that leaves public/ and reads secret/flag.txt.
Hint 1
Start from public/ and go up one level.
Hint 2
../secret/flag.txt
3) The fix
Resolve the path, then ensure it still starts with the allowed root. Prefer an allow-list of file names. Never pass raw user paths to the OS.
Simulated tools. They can only act on this lab's fake target inside the sandbox — there is no target field, no network, and nothing leaves your browser.
Dir / traversal bruteRuns a tiny wordlist and ../ sequences against the fake file system only.
$ dirbrute-sim --wordlist tiny
Recon (headers & forms)Lists the fake target's simulated headers and input fields.
$ recon-sim
Real scanners against real sites without permission are illegal. Use these ideas only on systems you own or are authorized to test.