← all rooms
LFI
Medium
Local File Inclusion
Traverse out of the images directory and read sensitive files.
Mission briefing
PixelVault hosts product images through a file viewer that picks assets from disk. Customers browse thumbnails via a filename parameter. Determine whether the viewer stays inside the intended image folder.
0 / 1 tasks
0 / 10 pts
Room cleared
Every task in this room is done. Your rank progress just moved forward.
Objectives
- Read /etc/passwd via path traversal
Task 1 Path Traversal Medium 10 pts
Scenario
PixelVault's viewer loads files from an images directory using a file parameter. Paths are built by concatenating your input onto a base folder. Read sensitive files outside the intended directory.
Your approach
- Request a legitimate image name and observe normal output.
- Try parent-directory segments to climb out of the images folder.
- Target a well-known system file to confirm arbitrary read.
- Locate the lab flag in virtual paths such as flag or a home secret file.
- Submit the flag text you retrieve.
The image viewer builds a path from your input with no sanitisation.
Open lab →Hint
?file=../../../../etc/passwd then try ../../../../flag