> For the complete documentation index, see [llms.txt](https://shadowforge.gitbook.io/shadowforge-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shadowforge.gitbook.io/shadowforge-writeups/bugforge.io/readme.txt/daily-labs/file-inclusion/cafeclub.md).

# CafeClub

> CafeClub was back open for business, this time with the hint ***File Inclusion.***

Because the hint said ***File Inclusion,*** the first thing I do is **turn off all the extra filters in BurpSuite** (CSS, Images, ...). First thing I noticed was a GET request for an image.

<figure><img src="/files/rZzhcCgdSEamow6Eor5j" alt=""><figcaption></figcaption></figure>

This was the request I had to send to Repeater, because that looks like a path to a file. Once I did that, I just went up the chain with path traversal.

<figure><img src="/files/X0WgI1yOjpDoVcETRNNf" alt=""><figcaption></figcaption></figure>

I had to try a couple of directories, but eventually I got a quick win and saw the flag 🇧🇪