> For the complete documentation index, see [llms.txt](https://kunalwalavalkar.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kunalwalavalkar.gitbook.io/write-ups/portswigger-labs/server-side-topics/path-traversal/file-path-traversal-simple-case.md).

# File path traversal, simple case

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FwRfUBv2lqoVZDwWfkpWq%2F1.png?alt=media&amp;token=60f90fe4-7e31-449b-ad66-ae75c7f1ab2e" alt=""><figcaption></figcaption></figure>

Let's access the image.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FUOUQ1q2IcFVdQrAHHUGG%2F2.png?alt=media&amp;token=f9b9a5d4-129c-403b-947f-e3905574945c" alt=""><figcaption></figcaption></figure>

We can now intercept this request in [Burp Suite](https://portswigger.net/burp) using the `Proxy`.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F1VmuLDvt6dffth6PU5nH%2F3.png?alt=media&amp;token=6648befe-4a88-4b65-b67b-5ef029753a0f" alt=""><figcaption></figcaption></figure>

As we can see the name of the image file is being passed into the `filename` parameter.

Now, we can forward the request to the `Repeater` to makes changes in it.

Let's change the `filename` parameter to the following and forward the request:

```
../../../etc/passwd
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FqNEwbfOSUcSoLfIbNyzK%2F4.png?alt=media&amp;token=49549ca8-7ac7-40ff-91fb-67333220b8bf" alt=""><figcaption></figcaption></figure>

We have successfully solved the challenge.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FUr3h20NKTjsslg1a76s2%2F5.png?alt=media&amp;token=1669a1c9-0bf2-4d1d-924a-404f6ff965cc" alt=""><figcaption></figcaption></figure>
