webeasy
Gadget Shop
hackerlab
Task: a Flask/Werkzeug shop exposed a shipping calculator that accepted product_id and zip_code via POST to /shipping. Solution: exploit command injection in zip_code with a semicolon, enumerate /app, and bypass the flag keyword filter with shell globbing using /app/fl*.
$ ls tags/ techniques/
arbitrary_file_readsemicolon_command_injectionshell_globbing_bypass
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub to get started.
$ssh [email protected]