PathRelay — Limited Path Traversal to RCE

hackadvisor

Task: Java/Tomcat admin panel with file download endpoint, WAF-protected path traversal, and hidden servlets. Solution: Webapp-relative path traversal to read WEB-INF/web.xml, discover hidden endpoints, extract credentials from incident report logs, authenticate to Groovy console for RCE, and exfiltrate flag via log files.