In this video, we cover Lab #6 in the Directory Traversal Vulnerabilities module of the Web Security Academy. This lab contains a file path traversal vulnerability in the display of product images. The application validates that the supplied filename ends with the expected file extension. To solve the lab, retrieve the contents of the /etc/passwd file. ▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬ Buy my course: https://academy.ranakhalil.com/p/web-security-academy-video-series ▬ 📚 Contents of this video 📚 ▬▬▬▬▬▬▬▬▬▬ 00:00​​​ - Introduction 00:13 - Web Security Academy Course (https://bit.ly/30LWAtE) 01:23 - Navigation to the exercise 01:58 - Understand the exercise and make notes about what is required to solve it 02:28 - Exploit the lab 04:43 - Script the exploit in Python 10:57 - Summary 11:05 - Thank You ▬ 🔗 Links 🔗 ▬▬▬▬▬▬▬▬▬▬ Notes.txt document: https://github.com/rkhal101/Web-Security-Academy-Series/blob/main/directory-traversal/lab-06/notes.txt Python script: https://github.com/rkhal101/Web-Security-Academy-Series/blob/main/directory-traversal/lab-06/directory-traversal-lab-06.py Web Security Academy Exercise Link: https://portswigger.net/web-security/file-path-traversal/lab-validate-file-extension-null-byte-bypass Rana's Twitter account: https://twitter.com/rana__khalil