{"id":32,"date":"2023-01-13T20:22:26","date_gmt":"2023-01-13T20:22:26","guid":{"rendered":"http:\/\/thered0ne.com\/?p=32"},"modified":"2025-12-29T19:46:00","modified_gmt":"2025-12-29T19:46:00","slug":"bugpoc-challenge-3-local-file-inclusion-lfi","status":"publish","type":"post","link":"https:\/\/thered0ne.com\/?p=32","title":{"rendered":"Bugpoc challenge #3 – Local file inclusion (LFI)"},"content":{"rendered":"
\n
\"\"<\/figure>\n<\/div>\n\n\n

$ Introduction:<\/strong><\/h2>\n\n\n\n

Bugpoc is a bug bounty program that was private in first place, and now is public. Everyone is hitting Bugpoc to hack their platform. I like Bugpoc program, I never saw a team with high level of professionalism, high hacking spirit and quick response time in submission process. <\/p>\n\n\n\n

We are all excited, and here we are with a new challenge and this one is different ! A local file inclusion (LFI). If you don’t know about the Local file inclusion here is a link for a quick definition: https:\/\/en.wikipedia.org\/wiki\/File_inclusion_vulnerability<\/a><\/p>\n\n\n\n

Without further ado, grab a cup of coffee and let’s start hacking!<\/p>\n\n\n\n

Challenge information:<\/strong> The vulnerable page: http:\/\/social.buggywebsite.com<\/a> Rules:<\/strong> This challenge has one rule and it’s quite simple: find your way to the demon’s lair, the ” \/etc\/passwd<\/strong>“.<\/p>\n\n\n\n

$ The web page:<\/strong><\/h2>\n\n\n\n

As you can see,  there is one input available, with limited options: 1- You can enter a text content to share. 2- Or, you can enter a URL to share.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

If you put a simple text, all what you will get is a “Twitter”<\/strong> & “Reddit”<\/strong> buttons. On the other hand, if you put  something shareable like a ” Facebook<\/strong>” or ” Reddit<\/strong>” URL, more buttons will appear as well as its content preview (See above image)<\/strong><\/p>\n\n\n\n

So, the questions that came up to my mind is how the content preview is generated?  Why does it appear just when we put a shareable URL ? and why this is not the case for a simple text ?<\/p>\n\n\n\n

To answer this, I had to make a research on that subject. I searched in google, I found that is something related to ” HTML Meta tags<\/strong>“. It wasn’t clear at first because I never experienced or had the chance to hack anything related to ” HTML Meta tags<\/strong>“. <\/p>\n\n\n\n

So, I have to say something important here, don’t hesitate to talk to the community. Sometimes we spend too much time just to find one keyword, one hint, or something that will lead us to our answers. Thus, asking a friend doesn’t make you a cheater. It is much easier and you save plenty of time; indeed, that’s what I did.  I asked a friend on discord  ( Acut3<\/strong><\/a> , a good hacker  \ud83d\udc4c ) , he told me that  I have to search for  “Opengraph metadata”,<\/strong> and there, will be your answers .<\/strong> Later on, Bugpoc<\/strong> put the first hint, which confirm the Actu3’s clue. <\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

I was surprised, about the “Meta tags” <\/strong>and the fact that contain a wealth of information that I never thought that it will be useful for me, until this very day.<\/p>\n\n\n\n

<\/circle><\/circle><\/circle><\/g><\/svg><\/span>