webmedium
NextPath
hackthebox
Task: Next.js 13.4.5 API endpoint with regex validation and path traversal checks. Solution: bypass all three checks using array query parameter — multiline regex matches first element, Array.includes differs from String.includes, and procfs symlinks pad path length to truncate .png extension via slice(0,100).
$ ls tags/ techniques/
lfipath_traversalnextjsregex_bypassmultiline_regexarray_type_confusionprocfs_symlinkslice_truncation
regex_multiline_bypassarray_vs_string_includespath_length_padding_with_procfs_symlinkspng_extension_truncation_via_slicenextjs_query_array_parsing
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub to get started.
$ssh [email protected]