Lo-Fi

Introduction

First lets start the machine. Once the machine start.. and the Ip address appears let’s go to the ip

once we are here, let’s click on coffe As you can see at the top of the page, ?page=coffe.php its seem to be vulnerable to Local FIle inclusion

Explanation of Local File Inclusion

Local File Inclusion (LFI) is a security vulnerability found in web applications where an attacker can manipulate the file paths used in file inclusion functions to include files that are not intended to be included. These files are typically located on the same server hosting the application, but the attacker may be able to access sensitive files or execute malicious scripts.

Let’s try with the most common command

../../../../etc/passwd

You ca see more Payloads here https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/File%20Inclusion/README.md#remote-file-inclusion

I tried to another directory

Well After a lot of time attempts trying to get the flag, I found the flag, that i even imagine that i could be there ../../../../flag.txt

As you can see here is the flag Complete

You know that Im learning english, if you see anything wrong, remember I’m learning