36 ms·
I spent a great deal of time using index.php and README as filename parameters, and using the contents of those files as the password attempt. This attack worke
by benmanns 14y ago
I spent a great deal of time using index.php and README as filename parameters, and using the contents of those files as the password attempt. This attack worked in my local environment, but not on the live ctf. It took a while to realize that `file_get_contents('nonexistent') === ''`, raising no exceptions.
- fooandbarify 14y agofile_get_contents('nonexistent') actually returns false, but calling trim() on that coerced it into an empty string.
- sanderjd 14y agoI used README and just manually stripped out all the whitespace. It worked fine. But a non-existent file is way more elegant I suppose.