First of all, this is the lab intro and requirement:

We need to fetch the contents of the /etc/passwd file.

As you are reading this, I believe that you have already solved previous labs and know that this is the traversal sequence we have been using so far:

../../../etc/passwd

But as the lab title says, “traversal sequences stripped with superfluous URL-decode”.

First, let’s see what that means.

Breakdown:

The word ‘superfluous’ means ‘unnecessary’.

‘Superfluous URL-decode’ means that if any URL encoding is present in the input, it will be decoded, unnecessarily, just as a security measure.

‘Traversal sequences stripped’ means that any traversal sequence in the input (if any), in our case, the input is the filename parameter, will be stripped away.

The whole “traversal sequences stripped with superfluous URL-decode” means that…