Failing easy local file inclusion challenge - mindreader (misc) Google CTF 2017

At first I was not able to solve the mindreader challenge and then I got spoiled. I have a critical look at my approach and figured out two major mistakes I made.

-=[ 🔴 Stuff I use ]=-

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

-=[ 📄 P.S. ]=-

All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

#CTF #WebSecurity

[Creased_]

"Getting stuck / failing is ok -> researching more... -> accidentally learn something, might as well not solve it"

Really good mindset, all challengers should share it 🙂

[olfmombach]

"That's interesting, but it doesn't give me anything"
Me everytime at CTF challenges

[Ljk]

It is a super critical lesson. This is why I am such a big fan of your channel: It's not only the technical bits that are passed to the viewer, but important tactics, and cultural knowledge, as well.

[trevorfacer]

Thank you for explaining the mistakes rather than editing them out and simply solving the challenge. It provides an additional learning experience.

[xdeadbeefee]

You're by far the most knowledgable YouTuber doing CTF/hacking-related stuff.

[murchmurch]

Not kidding: ive seen so many of your videos that sometimes it looks like a friend showing me stuff. Tks a lot

[rage]

“Sanity Check” would love to see you try that

[TechnikZaba]

Gynvael Coldwind on the last stream show how to properly solve this task

[conflagration]

What exactly was the idea behind choosing and inputting the specific /proc files into the path instead of some other file? In other words, why are these specific files more interesting to look at? Couldn't the answer be in some other random file?

[michael-gary-scott]

The first things I go for when I find LFI are index.php, index.js and main.py.

[George-pvlq]

why trying to read from /dev/fd/1(for example) didn't work? i remember a ctf challenge that you could read the flag from a file descriptor after the program opened a file.txt, is there a reason that the request in the video didn't work?

[luckythandel]

How would you suppose to know that if we have a main.py on that server? do we need to fuzz it?
please someone answer, I am curious.

[theosls]

Some hints might help in case when you think completely wrong, but in this case I think you had it. People should use spoilers for stuff like these :P

[alekescalante]

Did u take notes on the other challenges u did complete

[idkfkingknowlmao]

The question on my mind is... how were you supposed to know that there was a file called main.py in the current directory? Since you can only do file inclusion and not command injection.

[ayberkeser]

Yesterday I was solving a CTF asking me to examine files from the android backup file, I examined the files I recovered down to binary data. Half an hour later I noticed that the flag is written in an image file. Sometimes the answers are simpler than we expected.

[abiralshrestha]

Awesome one !! Hoping for videos on other challenges soon :D

[mohammaddh]

hi
i have the knowledge of ceh and sans 542 and i know owasp top ten but, real world have a big difference with courses examples
so please tell me where i can gain some good experience that help me in real hacking
i need every resource (book, video, ...)
please this is more than a dream for me its a goal

[nlahmi]

how would you realize the file is main.py? just by trying out things or is there another way?

[sayantandatta]

You are awesome just like your content, only thing increase the audio make it louder please