ctfshowweb14

### CTFShow Web 14 Challenge Information and Solution

For the CTFShow Web 14 challenge, this involves exploiting a file inclusion vulnerability to gain access to sensitive files on the server. The main goal is typically to read the flag from a specific location.

The web application allows users to input data that influences which file gets included into the page content without proper validation or sanitization of user inputs[^1]. This can lead to an attacker being able to specify arbitrary paths leading to unauthorized disclosure of system files.

To solve such challenges:

A common technique used by participants includes crafting URL parameters designed specifically for triggering Local File Inclusion (LFI). For instance, manipulating query strings like `?page=../../../../etc/passwd` could reveal underlying operating system details depending upon how securely coded the backend logic handling these requests happens to be[^2].

Another approach might involve identifying if remote file inclusion vulnerabilities exist within the target environment allowing attackers not just limited local traversal but also fetching external resources controlled entirely outside what developers intended originally when designing their applications[^3].

import requests

url = "http://example.com/vulnerable_page"
payload = "?file=php://filter/convert.base64-encode/resource=config"
response = requests.get(url + payload)

if response.status_code == 200:
    print("[+] Successfully retrieved encoded config.")
else:
    print("[-] Failed to retrieve config.")