I am pentesting an application. The application exposes a SOAP API, which I have access to, and internally that API makes the following call:
The contents of that file is then returned to me. I'm trying to exploit this to read any file on the server.
I can control the
resName variable, so I can use path traversal (../) to navigate the entire C: drive. The problem is, because the file path ends with .res, I can only access .res files. Are there any Windows/NTFS/C# tricks that will cause the .res to be ignored, so that I can read any file on the server?