File path traversal, traversal sequences stripped with superfluous URL-decode

Link of the lab: https://0a6e00e3037c83c680d3b78800420021.web-security-academy.net/

Turn on the Foxy proxy and set it to the Burpsuite.

Go to the HTTP history and you will find the image file and just click on one and send it to the repeater.

You should double encode the ../../../etc/passwd. IF you double encode it, You will get the following result. You might be thinking why i double encode it when i could encode it once. That’s because in the description it says superfluous decode which means that it decodes more than once so we have to encode it more than once.

This is the payload that we double encode and we are going to send this to see the response.

So, This is the response that we received and the lab is solved.

Congragulations, you solved the lab……………..