Lab 156 — IntegraFlow — Path Traversal via Double URL Encoding

hackadvisor

Task: Express.js API integration platform serves documentation files via /api/resources/* endpoint with path traversal protection. Solution: double URL encoding (%252e%252e%252f) bypasses validation that checks raw URL but uses double-decoded params for file access, allowing arbitrary file read including /root/flag.txt.