Web01-WhiteHat Challenge 04 (2017) Write-up

Threads: Search vulnerabilities on the website. Then get credentials to open new vulnerable functions and exploit to get flag.
Link: Challenge Web01-WhiteHat Chellenge 04 (2017)

Solve:
-First: I've found links: http://chall04-web01.wargame.whitehat.vn/?p=dogs and http://chall04-web01.wargame.whitehat.vn/?p=cats.
 I think the vulnerability website is LFI.

-I see ?p=dogs and ?p=cats so I think code-behind will look like:
     error_reporting(0); // hidden PHP's error.
     if(isset($_GET['p'])) {
   $file=$_GET['p'].'.php';
   if(!file_exists($file)){
   if (!strpos($file,"filter")) {
   $file='index.php';
   }
   }