The traversal the filter missed

A download endpoint blocks ../ in file names. One request still came back 200 with the size of /etc/passwd. Find the encoding that slipped through and what else it read.

Terminal mission
Intermediate
3 objectives
0 of 3 solved

Briefing

docs-01 serves PDFs through /download?file=<name>. After a pen test last year, a filter was added that rejects file names containing ../ or %2e.

Rejected requests return 400 with a 31-byte body. A real PDF is hundreds of kilobytes. Anything else in between deserves a look.

analyst@docs-01

docs-01 · Web server logs

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@docs-01:~$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.