picoCTF Forbidden Paths writeup

Here is our challenge:

We are told that the website files live in /usr/share/nginx/html/ and the flag is at /flag.txt.

I decided to type ../../../flag.txt and read.

Read.

And there's the flag!