File upload and path traversal flaws
You find code that builds file paths from user input or trusts uploaded files, test the weak checks with Burp and close them with safe storage and canonical path checks.
Level 201 · 15 lessons · 13 practice labs
Lessons
Path traversal
- How path traversal is born in code: a file path from user input
- Trying ../ and its encoded forms with Burp
- Local file inclusion: PHP include and template paths
- The fix: canonical paths, allow-lists and a root-folder check
- Short task: close the path traversal in a download endpoint
File upload
- Upload risks: executable files, oversized files and harmful content
- Weak checks: extension, MIME type and magic bytes
- Testing the checks by changing the upload request in Burp
- XSS arriving through SVG and HTML uploads
- Path traversal on archive extraction: zip slip
- Short task: evidence three weak checks in an upload form
Safe design
- Safe storage: outside the web root, random names and a separate domain
- Reprocessing content: re-encoding images and stripping metadata
- Spotting upload attacks in logs and on the file system
- Capstone: rebuild a profile-photo and document upload feature safely
Practice labs
- ../ in a download endpoint: Prove the invoice download endpoint can leave its folder and add a canonical path and root folder check.
- Local file inclusion in a theme picker: Prove the local file inclusion in code that adds the theme name to a file path and bind the theme name to a fixed list.
- A filter bypassed with encoded ../: Prove a filter that strips ../ but misses encoded forms and replace it with proper path validation.
- An absolute path in a log viewer: Prove a log viewer that blocks relative paths but accepts absolute ones and rewrite it to pick files by ID.
- Zip slip: path traversal in an archive import: Prove file names in an imported archive can escape the target folder and write code that checks each entry before extraction.
- An upload that only checks the MIME type: Prove a forbidden file is accepted by changing the MIME type in the request and add content-based validation.
- Double extensions and case tricks: Show a file that gets past the extension check with a double extension and capitals and apply the allow list to the normalised name.
- Stored XSS through an SVG avatar: Show that an SVG avatar upload runs script on the profile page and reject or rasterise SVG.
- A document upload with no size limit: Prove a form allows uploads of unlimited size and number, set limits at the server and app layers and log quota breaches.
- Uploads stored in the web root: Show uploaded files are served straight from the web root and move storage outside it with random names.
- Location metadata in a photo: Prove profile photos are published with location metadata and add a step that re-encodes the image and strips metadata.
- An upload attack on the file system: Trace a suspicious file in the upload folder and the access log and report when and from whom it came.
- Rebuild document upload securely: Rebuild the document upload feature of the fictional Tarnova Law portal with a separate domain, content checks and monitoring and test it.
About this course
You find code that builds file paths from user input or trusts uploaded files, test the weak checks with Burp and close them with safe storage and canonical path checks.
What you will learn
- Path traversal
- File upload
- Safe design
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.