Avatar

Labs / LFI Log Poison

  • Daily Challenge
  • Released 11 Aug 2025
The lab needs to be started first.
Need help to start?
Daily Challenge

LFI Log Poison - Challenge Description

Challenge Overview

Welcome to SecureCorp's Admin Dashboard! This enterprise-grade management system provides administrators with comprehensive tools for system monitoring, user management, log analysis, and server configuration. The platform features a sophisticated log viewer that allows administrators to monitor various system components including Apache access logs, error logs, and system events.

Learning Objectives

  • Understand Local File Inclusion (LFI) vulnerabilities and exploitation techniques
  • Learn User-Agent log poisoning methods for achieving remote code execution
  • Practice advanced web application security testing methodologies
  • Master file system enumeration and access techniques in Linux environments

Challenge Details

The SecureCorp Admin Dashboard features multiple administrative functions including a powerful log viewing system. Your goal is to explore the application's file handling capabilities, identify security weaknesses in the log viewer functionality, and use creative techniques to gain deeper system access and retrieve the hidden flag.

Technical Background

Local File Inclusion (LFI) vulnerabilities occur when applications dynamically include files based on user input without proper validation. When combined with log poisoning techniques, these vulnerabilities can escalate from information disclosure to remote code execution, making them particularly dangerous in enterprise environments.