webeasy

CSS

spbctf

Task: CSS minifier web app with source code on GitHub. Solution: LFI via file_get_contents() on user-controlled CSS url() path, bypassing weak stripos() extension check with path traversal.

$ ls tags/ techniques/
ssrflfipath_traversalphpfile_get_contentsarbitrary_file_readcss_minifier
source_code_reviewfile_get_contents_lfiweak_extension_check_bypasspath_traversal_with_fake_extensioncss_url_injection
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]