BBLABS v2BBLABSv2
>Home>Labs
>New labs

Latest 3 labs

Loading…

View all labs →
>Creators>Ranking
>Learn

Learn bug bounty

AcademyGuides, cheatsheets and glossaryVulnerabilitiesXSS, SQLi, IDOR, SSRF and moreHunter RoadmapYour step-by-step bug bounty pathBlogBug bounty guides and news
>Business>Pricing
ES
Log inLog in
>Home>Labs>New labs>Creators>Ranking>Learn>Business>Pricing
ES
Sign inCreate account
  1. Home
  2. Labs
  3. Path Traversal via Avatar Upload
EasyVDP30 min

Path Traversal via Avatar Upload

By @gorka

Foro de seguridad donde el nombre de archivo del avatar se preserva sin sanitizar, permitiendo leer archivos del sistema como /etc/passwd via path traversal.

338 views24 completedUpdated Aug 2026
Log in to start

Learn to find this bug

A real bug bounty report, reproduced for you to practice.

Create your account and practice real bugs that got paid. Download the environment, find it and learn the exact technique — your path to your first bounty.

hunters training
650

hunters training

labs from real reports
50

labs from real reports

completions
380

completions

in bounties practiced
$200,000

in bounties practiced

40 flags captured this week
Create account
I already have an account

Access to all labs · no commitment · cancel anytime

Hunters who solved it· 8

HO1
@horseman3 hours ago
danielmijan112
@danielmijan116 days ago
VA3
@vazquezdv1820056 days ago
flyingwhales
@flyingwhales17 days ago
MA
@mattkingst17 days ago
rodegarrido1
@rodegarrido120 days ago
cibx
@cibx28 days ago
AL
@alex.burja.200029 days ago

Objectives

1
Subir un avatar y observar la URL resultante
2
Notar que el filename se preserva en el path
3
Manipular el filename con ../../
4
Leer /etc/passwd a traves de la URL del avatar

Information

Difficulty
Easy
Duration
30 min
Bounty
VDP
Completed
24
Creator
gorka@gorka
Updated
Aug 2026

Download the environment

Reproduce it and find the bug yourself

Create account

Tools

Burp SuiteCurl

Prerequisites

  • Path traversal basico (../)
  • Manipulacion de uploads

Tags

Path Traversal

Achievement you'll earn

Solve this lab to unlock this shareable achievement

BBLABS.ESLab Solved
EasyVDP
// achievement_unlocked

Path Traversal via Avatar Upload

Path Traversal
Aug 2026
gorka
solved_by@gorkaMember since Mar 2026
bblabs.es// real bug bounty practice

Community writeups

Credenciales

Usuario Contrasena Rol
(registrar cuenta propia) user

Despliegue

# Opcion 1: autodeploy
./autodeploy.sh

# Opcion 2: manual
docker compose up --build

# Acceder
http://localhost:1300

Compatible con macOS, Linux y Windows (Docker Desktop / WSL).

Para parar:

./autodeploy.sh destroy
# o: docker compose down -v

Contenido del Lab

La aplicacion

ZeroDay Forum es un foro de seguridad informatica con perfiles de usuario y subida de avatares.

La vulnerabilidad

El endpoint de avatar preserva el filename del upload en la ruta del archivo sin sanitizar. GET /api/profile/avatar/:userId construye la ruta usando el filename almacenado, permitiendo traversal con ../../../../etc/passwd.

Cadena de ataque

1. Registrarse en el foro
2. Subir avatar con filename: ../../../../etc/passwd
3. Visitar /api/profile/avatar/:userId
4. Obtener contenido de /etc/passwd

Solucion interactiva

Accede a /writeup dentro de la aplicacion para una guia paso a paso con botones interactivos.

Flag

(contenido de /etc/passwd)

Remediacion

  1. Sanitizar filenames: eliminar ../ y caracteres especiales
  2. Usar path.basename() para extraer solo el nombre
  3. Almacenar archivos con nombres generados (UUID)
  4. Verificar que la ruta final esta dentro del directorio permitido

Contact

Practice, learn and hack

Bug bounty practice platform with labs based on real reports. Learn ethical hacking in safe environments.

contact→

Follow us

YouTube
@0xGorka
X
@gorkaelbochi
LinkedIn
gorka-el-bochi-morillo
Instagram
@_.gorkaaa.b
Email
team@bblabs.es

Access every lab from €7.99/mo

New labs every week. Cancel anytime.

Create account

BBLabs is the bug bounty labs platform where you learn bug bounty with real vulnerabilities extracted from paid reports on HackerOne, Bugcrowd and Intigriti. Here you practice web hacking —XSS, SQLi, IDOR, SSRF, CSRF and more— in downloadable environments, capture the flag, read the writeup and apply the technique on active bug bounty programs.

BBLabs is the alternative to HackTheBox, TryHackMe and PentesterLab for those who want to practice bug bounty with real reports instead of artificial CTFs. From €7.99/mo, no commitment.

→ Learn bug bounty from scratch→ How to do bug bounty step by step→ Real bug bounty reports→ BBLabs for companies and academiesLabsAcademyVulnerabilitiesToolsHunter rankingXSS labsIDOR labsSSRF labsCSRF labsHackTheBox alternativeHack4u alternativeTryHackMe alternativePortSwigger alternativePentesterLab alternativeBug Bounty Labs comparisonHackerOne to practiceOffSec / OSCP alternativeINE / eWPT alternativeHTB Academy alternativeDVWA alternativeJuice Shop alternativeVulnHub alternativePentesterAcademy alternativeRoot-Me alternativeHackTheBox vs TryHackMeBest bug bounty platforms 2026BlogSpoilersWhat is bug bounty?How much do you earn in bug bounty?OWASP Top 10 explainedBest sites to practice web hackingHow to become an ethical hacker from scratchBurp Suite tutorial (Spanish)OSCP guide and prepGoogle Dorks for bug bountyHow much an ethical hacker earns in SpainBug bounty tools 2026Best cybersecurity certifications 2026Burp Suite tutorialsqlmap tutorialffuf web fuzzingnuclei tutorialHTTP Request SmugglingWAF bypassPrompt injection (LLM)Google Dorks
Made withand code
TermsPrivacyComparisonES

© 2026 BBLABS v2 — All rights reserved