Read a file you should not, on an app you built, then close it

short · 55 min · Objective 4.4

Task

Exploit a path-traversal and a file-inclusion flaw in a weak application you built to read a file you were not meant to, then apply canonicalisation and an allow-list and confirm the fix — because path handling that trusts the client is one of the oldest and most reliable web flaws.

Steps

  1. On the lab you own, run an application that builds a file path from a client-supplied parameter, and place a marker file outside the intended directory.
  2. Use traversal sequences to read the marker file through the parameter, proving you reached outside the intended directory.
  3. Demonstrate local file inclusion where the included file is interpreted, and note how it could escalate from file read to code execution.
  4. Keep it to reading files you planted for the exercise — the proof is reaching outside the intended directory, not exfiltrating anything real.
  5. Fix it: canonicalise the resolved path and enforce an allow-list of permitted files, then confirm the traversal fails.
  6. Record before and after.

Verify

grep -ciE "traversal|\.\./|outside.*directory|marker file" /tmp/traversal.md
grep -ciE "inclusion|interpreted|code execution" /tmp/traversal.md
grep -ciE "canonicali|allow.?list|resolved path|fails now" /tmp/fix.md

The first count must be non-zero: you reached a file outside the intended directory through the parameter. The second must be non-zero: you noted how local inclusion escalates from read to execution. The third must be non-zero: you fixed it with canonicalisation and an allow-list and confirmed the traversal now fails — which is the remediation the report carries.

Notes

Traversal and inclusion both come from path handling that trusts the client. Canonicalisation resolves the real path so ../ cannot escape, and an allow-list means only known-good files are servable — escaping individual sequences is a patch, the allow-list is the fix. The marker files here are ones you planted, so the proof is reaching outside the directory, not touching anything real. Everything ran on an application you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.