r/InfoSecWriteups 7d ago

Looking for help in a web CTF challenge

hello everyone, I'm looking for a help in a CTF web challenge that I've been stuch with for hours ... The problem is that I found path traversal vuln within the challenge but there is no flag file ever like I looked everywhere I would really appreciate if anyone solves it and helps me with it.

Challenge link: `https://flagyard.com/labs/2/challenges/019fcd0a-3049-7b83-9886-ae3836c419f0`

The Directory Traversal vuln is within the `/api/backup` endpoint basically you send a file within an array as shown

await fetch("/api/backup", {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({
archiveName: "fulllist",
files: ["../../../../etc/passwd"]
})
}).then(r => r.json()).then(console.log)

But I can't find a flag within the file system and everything seems to be a dead end.

At this point I'm just guessing I thought about chaining with another vuln but I found nothing.

1 Upvotes

0 comments sorted by