Cody's First Blog Flag0 -- Found What was the first input you saw? Figuring out what platform this is running on may give you some ideas Code injection usually doesn't work Flag1 -- Found Make sure you check everything you're provided Unused code can often lead to information you wouldn't otherwise get Simple guessing might help you out Flag2 -- Found Read the first blog post carefully We talk about this in the Hacker101 File Inclusion Bugs video Where can you access your own stored data? Include doesn't just work for filenames