🗂️ LFI / RFI Lab

A simple photo gallery app. Each challenge exposes the same feature ("view a file from the gallery") with a different level of protection.

sunsetsunset.jpg
mountainsmountains.jpg
lighthouselighthouse.jpg
Easy · Challenge 1

No Validation

The viewer takes a file parameter and reads it straight off disk. No filtering, no allowlist, nothing.

Open challenge1.php →
Medium · Challenge 2

Naive Filter

This viewer strips ../ from the input before using it — but only once, and only that literal string.

Open challenge2.php →
Hard · Challenge 3

Remote File Inclusion

This one doesn't read local files by path at all — it include()s whatever page points to, local or remote.

Open challenge3.php →