webeasy

Соленый огурец (Salty Pickle)

hackerlab

Task: Flask notes app stores data in pickle-serialized cookies. Solution: Exploit insecure pickle deserialization via __reduce__ method to achieve RCE and read the flag.

$ ls tags/ techniques/
flaskrcepythonbase64cookie_manipulationpickledeserialization__reduce__
Insecure Pickle DeserializationRCE via __reduce__ methodCookie-based payload injection
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]