Post cover image

November 1, 2026

TryHackMe: Lo-Fi — Local File Inclusion (LFI) Walkthrough

A beginner-friendly walkthrough covering LFI discovery, FFuF fuzzing, directory traversal, and flag retrieval.

By Amin Khan

2 min read

TryHackMe — Lo-Fi Walkthrough

Room: Lo-Fi

Platform: TryHackMe

Difficulty: Easy

Author: cmnatic

Vulnerability: Local File Inclusion (LFI)

Introduction

Want to hear some lo-fi beats to relax or study? We've got you covered!

In this room, we are introduced to a Local File Inclusion (LFI) vulnerability. Our goal is to explore the web application, identify the vulnerable parameter, and exploit it to read local files from the server to retrieve the flag.

1. Exploring the Website

First, we visit the website provided by TryHackMe.

None

On the homepage, we can see different music genres listed under the Discography section, such as Relax, Sleep, Chill, Coffee, Vibe, and Game.

When clicking on any of these categories, we notice that the website uses a URL parameter called page to load the requested content.

The URL looks something like this:

http://lo-fi.thm/?page=

This parameter is interesting because it might be vulnerable to Local File Inclusion.

2. Testing for Local File Inclusion

Now that we have identified the page parameter, we can start testing it for LFI vulnerabilities.

We can use FFuF along with the LFI-Jhaddix wordlist to fuzz the parameter and identify possible file inclusion paths.

We run the following command:

ffuf -w /usr/share/wordlists/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt -u "http://lo-fi.thm/?page=FUZZ" -fl 124

Here is what the command does:

  • -w specifies the wordlist.
  • -u specifies the target URL.
  • FUZZ is the position where FFuF inserts each wordlist entry.
  • -fl 124 filters out responses containing 124 lines.

After running the scan, we get several interesting results that suggest the parameter may be vulnerable to Local File Inclusion.

3. Exploiting the LFI Vulnerability

To confirm the vulnerability, we try accessing the /etc/passwd file.

We use the following URL:

http://lo-fi.thm/?page=../../../etc/passw

passwd

The ../ sequences are directory traversal sequences that allow us to move backwards through directories until we reach the root directory.

None

As we can see, the server successfully returns the contents of /etc/passwd.

This confirms that the application is vulnerable to Local File Inclusion, allowing us to read files from the server.

4. Finding the Flag

Now that we have confirmed the LFI vulnerability, we can use it to access the flag file.

According to the challenge, the flag is located in the root directory of the system.

We modify our URL to include flag.txt:

http://lo-fi.thm/?page=../../../flag.txt
None

The server includes the requested file and displays its contents.

We have successfully retrieved the flag!

Conclusion

In this room, we learned how Local File Inclusion vulnerabilities can allow attackers to read sensitive files from a web server.

We identified the vulnerable page parameter, used FFuF to fuzz it, confirmed the vulnerability by reading /etc/passwd, and finally accessed flag.txt to complete the challenge.

Key takeaway: Always validate and sanitize user-controlled file paths. Applications should avoid directly using user input when including files.