BBLABS v2BBLABSv2
>Home>Labs
>New labs

Latest 3 labs

Loading…

View all labs →
>Creators>Ranking
>Learn

Learn bug bounty

AcademyGuides, cheatsheets and glossaryVulnerabilitiesXSS, SQLi, IDOR, SSRF and moreHunter RoadmapYour step-by-step bug bounty pathBlogBug bounty guides and news
>Business>Pricing
ES
Log inLog in
>Home>Labs>New labs>Creators>Ranking>Learn>Business>Pricing
ES
Sign inCreate account
  1. Home
  2. Labs
  3. Client-Side Path Traversal to Admin Password Change
HardVDP30 min

Client-Side Path Traversal to Admin Password Change

By

Learn to find this bug

A real bug bounty report, reproduced for you to practice.

Create your account and practice real bugs that got paid. Download the environment, find it and learn the exact technique — your path to your first bounty.

hunters training
650

hunters training

labs from real reports
50

labs from real reports

completions
380

completions

in bounties practiced
$200,000

in bounties practiced

40 flags captured this week
Create account
I already have an account

Access to all labs · no commitment · cancel anytime

Hunters who solved it· 8

lmarco831
@lmarco8311 hours ago
kaneki2
@kaneki4 days ago
kr3b7

Achievement you'll earn

Solve this lab to unlock this shareable achievement

BBLABS.ESLab Solved
HardVDP
// achievement_unlocked

Client-Side Path Traversal to Admin Password Change

Path Traversal
Aug 2026
gorka
solved_by@gorkaMember since Mar 2026
bblabs.es// real bug bounty practice

Community writeups

Despliegue

# Opcion 1: autodeploy
./autodeploy.sh

# Opcion 2: manual
docker compose up --build

# Acceder
http://localhost:1500

Compatible con macOS, Linux y Windows (Docker Desktop / WSL).

Para parar:

./autodeploy.sh destroy
# o: docker compose down -v

Contenido del Lab

La aplicacion

ZeroDay Forum con funcionalidad de Password Vault donde el parametro de URL se usa en la ruta de la API del cliente.

La vulnerabilidad

El Password Vault construye la URL de la API usando un parametro de la URL: /api/vault/${param}. Mediante path traversal (..%2F..%2Fauth%2FchangePassword?pass=hacked123), se puede redirigir la peticion al endpoint de cambio de contrasena.

Cadena de ataque

1. Analizar URL del Password Vault
2. Descubrir inyeccion de path en la API del cliente
3. Crear URL: /vault/..%2F..%2Fauth%2FchangePassword?pass=hacked123
4. Publicar en el foro
5. Admin bot visita → contrasena cambiada
6. Login como z3r0c00l → Flag

Solucion interactiva

Accede a /writeup dentro de la aplicacion para una guia paso a paso con botones interactivos.

Flag

827ccb0eea8a706c4c34a16891f84e7b

Remediacion

  1. Nunca concatenar input del usuario en rutas de API
  2. Validar y sanitizar parametros de URL
  3. Usar IDs en vez de paths para referenciar recursos
  4. Server-side: validar que la ruta solicitada es valida

Contact

Practice, learn and hack

Bug bounty practice platform with labs based on real reports. Learn ethical hacking in safe environments.

contact→

Follow us

YouTube
@0xGorka
X
@gorkaelbochi
LinkedIn
gorka-el-bochi-morillo
Instagram
@_.gorkaaa.b
Email
team@bblabs.es

Access every lab from €7.99/mo

New labs every week. Cancel anytime.

Create account

BBLabs is the bug bounty labs platform where you learn bug bounty with real vulnerabilities extracted from paid reports on HackerOne, Bugcrowd and Intigriti. Here you practice web hacking —XSS, SQLi, IDOR, SSRF, CSRF and more— in downloadable environments, capture the flag, read the writeup and apply the technique on active bug bounty programs.

BBLabs is the alternative to HackTheBox, TryHackMe and PentesterLab for those who want to practice bug bounty with real reports instead of artificial CTFs. From €7.99/mo, no commitment.

→ Learn bug bounty from scratch→ How to do bug bounty step by step→ Real bug bounty reports→ BBLabs for companies and academiesLabsAcademyVulnerabilitiesToolsHunter rankingXSS labsIDOR labsSSRF labsCSRF labsHackTheBox alternativeHack4u alternativeTryHackMe alternativePortSwigger alternativePentesterLab alternativeBug Bounty Labs comparisonHackerOne to practiceOffSec / OSCP alternativeINE / eWPT alternativeHTB Academy alternativeDVWA alternativeJuice Shop alternativeVulnHub alternativePentesterAcademy alternativeRoot-Me alternativeHackTheBox vs TryHackMeBest bug bounty platforms 2026BlogSpoilersWhat is bug bounty?How much do you earn in bug bounty?OWASP Top 10 explainedBest sites to practice web hackingHow to become an ethical hacker from scratchBurp Suite tutorial (Spanish)OSCP guide and prepGoogle Dorks for bug bountyHow much an ethical hacker earns in SpainBug bounty tools 2026Best cybersecurity certifications 2026Burp Suite tutorialsqlmap tutorialffuf web fuzzingnuclei tutorialHTTP Request SmugglingWAF bypassPrompt injection (LLM)Google Dorks
Made withand code
TermsPrivacyComparisonES

© 2026 BBLABS v2 — All rights reserved

@gorka

Foro donde un parametro de URL se inyecta en la ruta del API del cliente. Mediante CSPT se puede redirigir la peticion al endpoint de cambio de contrasena del admin.

320 views23 completedUpdated Aug 2026
Log in to start
3
@kr3b7
Jun 2026
ZN
@znbzJun 2026
benjaminnocervigni
@benjaminnocervigniJun 2026
DN
@dntbetheheroJun 2026
scuffy-sh
@scuffy-shJun 2026
pl4nkton
@pl4nktonJun 2026

Objectives

1
Descubrir que el parametro de URL del Password Vault se inyecta en la ruta API del cliente
2
Crear una URL CSPT que redirija al endpoint de cambio de contraseña
3
Publicar la URL en el foro para que el admin bot la visite
4
Verificar que la contraseña del admin fue cambiada

Information

Difficulty
Hard
Duration
30 min
Bounty
VDP
Completed
23
Creator
gorka@gorka
Updated
Aug 2026

Download the environment

Reproduce it and find the bug yourself

Create account

Tools

Burp SuiteURL encoder

Prerequisites

  • Path traversal avanzado
  • Client-side path traversal (CSPT)
  • URL encoding

Tags

Path Traversal