I am doing the PUT and DELETE methods in the academy. The question is: Create a file named “flag.php” with contents ‘<?=`cat /flag.txt`;?>’ and request it to get the flag.
I have been on it for three hours and cannot figure it out. I tried with Burp to do the PUT request in the repeater with the copied content. I have tried with and without apostrophes, with and without <>. Nothing works. I know I have entered the backticks correctly. Regardless of what I write in the file, it always displays the content from the file on the webpage and no flag.
I have also tried to nano a file named flag.php with the copied content from the academy site and POST it on the server, with Burp or with curl and it does not work.
Anything else I can try? I have run out of options at this point.