Symlink Sabotage: ZIPping Through Web Security. (LFI Lab)

iCSI Security Operations Center Classroom

Objective: Learn how to exploit web applications that accept file uploads using symlinks within ZIP files.

Time to complete: ~20–30 minutes.

In this lab Participants will:

Craft a unique ZIP file using Python, embedding a .pdf with a cleverly preserved symlink.Utilize this technique to navigate the web server’s filesystem.iCSI students can enter the final flag found on our local cyber range scoreboard.

VM with walkthrough can be found here.