webProeasy

Tsunami

alfactf

Task: Web shop with bonus system where bonus_amount is validated by string length (max 3 chars) but then converted to float. Solution: Use scientific notation (9e9 = 9 billion) to bypass length check and get unlimited balance to buy the flag item.

$ ls tags/ techniques/
shopfastapiscientific_notationtype_confusioninput_validation_bypasspythonfloat_parsing
Scientific notation bypass for length validationType confusion (string to float conversion)
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups