"""
This code is attempting to perform a path traversal attack on your endpoint. Here's how it works:
The code imports the requests library, which is commonly used for making HTTP requests.
It defines the URL of your endpoint as url = 'http://localhost:9600/upload_avatar'.
It specifies the path to the file you want to upload as file_path = 'test.txt'.
It opens the file in binary mode using open(file_path, 'rb') and assigns it to the variable f.
It creates a dictionary called files with a single key-value pair. The key is 'avatar', which corresponds to the name of the file input field in your endpoint. The value is a tuple containing the file path and the file object f. In this case, the file path is '../../../../../../../../tmp/teeest.txt', which attempts to traverse up multiple levels in the directory structure and access the file located in /tmp/teeest.txt.
It sends a POST request to your endpoint with the files dictionary as the files parameter, which includes the file path traversal attempt.
Finally, it prints the response from the server.
This code is trying to exploit the path traversal vulnerability in your endpoint by specifying a file path that includes multiple ../ sequences to traverse up the directory structure and access a file outside of the intended directory.
To protect against this type of attack, you should implement the measures I mentioned earlier, such as file validation, randomized file names, and using a dedicated directory for storing uploaded files. Additionally, make sure to sanitize and validate all user input to prevent malicious file paths from being accepted.
"""


import requests

# Endpoint URL
url = 'http://localhost:9600/upload_avatar'

# Path to the file you want to upload
file_path = 'test.txt'

# Open the file in binary mode and send it as 'avatar'
with open(file_path, 'rb') as f:
    files = {'avatar': ('../../../../../../../../tmp/teeest.txt', f)}
    response = requests.post(url, files=files)

# Print the response from the server
print(response.json())