webPromedium

Джарвис (Jarvis)

hackerlab

Task: Flask web app with WAV file upload and speech-to-text functionality, hidden KeyCodes page mapping F-keys to special characters. Solution: SSTI via voice command injection - speak "F5 F5 config F6 F6" to inject {{config}} and leak SECRET_KEY.

$ ls tags/ techniques/
flasksstipythonspeech_to_textserver_side_template_injectionjinja2werkzeugvoice_command_injectionwav_uploadgttskeycodesaudio_payload
Server-Side Template Injection (SSTI) via speech-to-textVoice command injection through WAV file uploadKeyCodes bypass for special characters injectionFlask config disclosure via {{config}}
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups