webPromedium
PathRelay — Limited Path Traversal to RCE
hackadvisor
Task: Java/Tomcat admin panel with file download endpoint, WAF-protected path traversal, and hidden servlets. Solution: Webapp-relative path traversal to read WEB-INF/web.xml, discover hidden endpoints, extract credentials from incident report logs, authenticate to Groovy console for RCE, and exfiltrate flag via log files.
$ ls tags/ techniques/
multi_stagewaf_bypasspath_traversaljavacredential_leakadmin_paneltomcathoneypot_flaggroovy_rcejsflog_exfiltrationincident_reportwebapp_relative_path
honeypot_flag_identificationwebapp_relative_path_traversalhidden_endpoint_discovery_via_web_xmlcredential_extraction_from_log_filesgroovy_script_console_rcelog_based_output_exfiltrationparameter_name_fuzzing
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 364 — PulseRelay — Path Traversal to RCE via Plugin Upload— hackadvisor
- [web][Pro]Lab 29 — PackForge — Path Traversal to RCE via Template Injection— hackadvisor
- [web][Pro]Lab 13 — WebForge — Insecure Deserialization in Config Import— hackadvisor
- [web][Pro]DecisionForge— hackadvisor
- [forensics][free]RedTrails— hackthebox