Local File Inclusion

Scenario

PixelVault's viewer loads files from an images directory using a file parameter. Paths are built by concatenating your input onto a base folder. Read sensitive files outside the intended directory.

Your approach

1. Request a legitimate image name and observe normal output.
2. Try parent-directory segments to climb out of the images folder.
3. Target a well-known system file to confirm arbitrary read.
4. Locate the lab flag in virtual paths such as flag or a home secret file.
5. Submit the flag text you retrieve.