# File path traversal, traversal sequences stripped with superfluous URL-decode

<figure><img src="/files/qasrlt0zl4Xfqgfsgpkm" alt=""><figcaption></figcaption></figure>

Let's access the image.

<figure><img src="/files/yZySshqe8aVZDIjGeScy" alt=""><figcaption></figcaption></figure>

We can now intercept this request in [Burp Suite](https://portswigger.net/burp) using the `Proxy`.

<figure><img src="/files/2iJN9eEL1DRuqc64f0Pd" alt=""><figcaption></figcaption></figure>

Now, we can forward the request to the `Repeater` to makes changes in it.

Let's change the `filename` parameter to the following and forward the request:

```
../../../etc/passwd
```

<figure><img src="/files/EMG9JLMaBRjWSHjBIVXP" alt=""><figcaption></figcaption></figure>

The server tells us that the file does not exist. This is because the `../` characters are being stripped from our parameter.

| Original parameter  | Stripped parameter |
| ------------------- | ------------------ |
| ../../../etc/passwd | etc/passwd         |

We can bypass this by URI encoding the `../../../` character sequence. This way when the server tries to match the pattern, it won't find it because it has been encoded.

<figure><img src="/files/fsnOdo7Tnn1hWnMcB7XM" alt=""><figcaption></figcaption></figure>

Now we can set the `filename` parameter to the following:

```
%25%32%65%25%32%65%25%32%66%25%32%65%25%32%65%25%32%66%25%32%65%25%32%65%25%32%66etc/passwd
```

<figure><img src="/files/CnbYiHUzp1iuHZWHIpn9" alt=""><figcaption></figcaption></figure>

We have successfully solved the lab.

<figure><img src="/files/rpjjiK85g7SgeeLV5mmp" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://kunalwalavalkar.gitbook.io/write-ups/portswigger-labs/server-side-topics/path-traversal/file-path-traversal-traversal-sequences-stripped-with-superfluous-url-decode.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.