webeasy

Поздравительное приложение (Greeting App)

hackerlab

Task: Flask greeting app with user input reflected in response, flag is SECRET_KEY. Solution: Jinja2 SSTI via {{config.SECRET_KEY}} to read Flask config.

$ ls tags/ techniques/
flasksstipythonserver_side_template_injectionjinja2werkzeugconfig_disclosuresecret_key
Server-Side Template Injection (SSTI) in Jinja2Flask config.SECRET_KEY disclosure
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]