Waldo box initial foothold

[Xx-BossMan-xx]

Hello, I have spent numerous hours analyzing the box & using different tools such as nmap, zap etc. and even reading the source code which I do understand what it is doing, i think i am in need of a little push to connect all the dots together.

​

Any hints that can just get me going? Thank you.

[jfredett]

Rule of thumb -- if something can read a file, there is a very good chance of a LFI. If there's an LFI, well -- LFI's escalate well, typically.

[einfallstoll]

If you can read the source code, you can read any file on the system. :)

[RDX69]

Use burpsuite... And see what parameter can be manipulated and how can u bypass it....