Challenge description

Can you get the flag? Here’s the website. We know that the website files live in /usr/share/nginx/html/ and the flag is at /flag.txt but the website is filtering absolute file paths. Can you get past the filter to read the flag?

Category: Web Exploitation

Solution

First, I tried to input /flag.txt, but that sadly doesn’t work. After a few minutes of contemplation, I suddenly recalled how web browsers can be used as file browsers by simply replacing https:// with file://, followed by a destination (file:///, for example, will show you the contents of your root directory).

So I tried to input file:///flag.txt instead and voila!