There is a CTF Problem that it needs to see comments of a PHP file using some vulnerabilities of PHP; The Question is:
In the link bellow You must change lorem.php to read exact php comments of index.php file

I have tried index.php but it makes a infinite loop. And I now the permissions is wrong; e.g. /etc/passwd will show the passwd file and the flag in /etc/passwd is for another challenge

closed as off-topic by ThoriumBR, Steve Dodier-Lazaro, Xander, WhiteWinterWolf, Bob Brown Jun 4 '15 at 11:21

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – ThoriumBR, Steve Dodier-Lazaro, Xander, WhiteWinterWolf, Bob Brown
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Welcome to Information Security. Are you asking how to solve the CTF problem? Can you show what you have tried and narrow your question a little? The community is less responsive if it feels like you are asking for all the work to be done for you. – amccormack Jun 3 '15 at 4:51
  • 1
    I'd like to answer this question because this was a lot of fun to solve and I didn't know about this technique until you posted the question. But, I want to respect the game that ringzer0team has set up. The challenge provides an option to "purchase" a hint, if you want to go that route. I searched online and couldn't find a writeup, and I don't want to make the first public one. If you can make a question that isn't related to a specific CTF problem, it would be easier to answer. – amccormack Jun 3 '15 at 6:11
  • To see such samples we need a server that can load php sample. And I don't have one. – M.Fooladgar Jun 3 '15 at 7:31

If you encounter a local file inclusion (LFI) vulnerability there is a special technique that enables you to read files from the target system by making use of a PHP wrapper. This will not work in every case but you might want to give it a try.

You can read more about the PHP wrapper on the official php.net site:

This technique basically lets you use PHPs input and output streams as well as apply different filters to them. (http://php.net/manual/en/filters.php)

To read a resource you can use a payload in the form of:



To apply a filter replace filtername with the name of the filter:


In some cases there will be errors depending on the specific implementation and surroundings of the LFI.
A good way do handle these can be to convert the output in a way that will not be interpreted by the target server.

On filter you might want to look at is the


filter that converts the stream data to base64.

Not the answer you're looking for? Browse other questions tagged or ask your own question.