webeasy

Конвертер (Converter)

hackerlab

Task: ASCII encoder/decoder web app with Flask/Jinja2 backend. Solution: SSTI via ASCII-encoded payload - decoded text is rendered through Jinja2 template engine, allowing RCE via request.application.__globals__.

$ ls tags/ techniques/
flaskrcesstipythonserver_side_template_injectionjinja2werkzeugencodingascii
Server-Side Template Injection via ASCII decodePayload encoding to bypass input restrictionsRCE via request.application.__globals__
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]