Burp Suite is an essential tool for every web CTF player.

Functions as a proxy to inspect and manipulate requests between the client and server.

• Capturing, modifying, and forwarding requests.

• Using features like the Repeater to test and exploit vulnerabilities.

Proxy Feature : Acts as an intermediary between your browser and the server

Captures all requests sent and responses received.

The Repeater allows you to:

• Modify requests (e.g., methods, paths, headers, cookies).

• Test vulnerabilities by altering inputs

Common Web Vulnerabilities

Local File Inclusion (LFI)

What is LFI?

Local File Inclusion occurs when an application allows user-controlled input to specify files for inclusion.

An attacker can access unauthorized files on the server (e.g., /etc/passwd), potentially leading to sensitive information disclosure or Remote Code Execution (RCE).

Code Vulnerability

@app.route('/view', methods=['GET'])
def view():
file = request.args.get('file', 'index.html')
with open(file, 'r') as f:
content = f.read()
return content

Issue: The file parameter is directly used in the open function without validation.