Overview
The page has two navigation links:
page parameter controls what content is loaded. The page source contains a hint:
Hints
Hint 1 — What is the page parameter doing?
Hint 1 — What is the page parameter doing?
The
?page= parameter changes what content is rendered. In PHP, this is commonly done by passing the parameter to an include() or require() call — the value becomes part of the file path. What happens if the value you pass isn’t a page name, but an absolute path to a file on the server?Hint 2 — Where is the password?
Hint 2 — Where is the password?
The HTML comment tells you exactly where the password file lives:
/etc/natas_webpass/natas8. If the include() call doesn’t restrict input to relative paths, you can supply that absolute path directly as the page parameter.Solution
Full walkthrough
Full walkthrough
1
Identify the vulnerability
The
?page= value is passed directly into a PHP include() without validation. This is a Local File Inclusion (LFI) vulnerability — any readable file on the server’s filesystem can be included.2
Include the password file
Navigate to:PHP includes
/etc/natas_webpass/natas8 and renders its contents inline in the page.Never pass user input directly to
include(), require(), file_get_contents(), or any function that opens a file path. Validate against a strict allowlist of permitted page names and never allow absolute paths or traversal sequences (../).