Difficulty: Insane
Welcome to the Iron Vault. We have implemented the most secure file viewer. We strip out all path traversals (../) and we completely block PHP wrappers (php://). The flag is safely stored outside the web directory in ../secret_data/flag.txt. You will never read it.
php://. Think about how str_replace works."
👉 Download Source (if you are lazy)