webmedium
Джарвис (Jarvis)
hackerlab
Task: Flask web app with WAV file upload and speech-to-text functionality, hidden KeyCodes page mapping F-keys to special characters. Solution: SSTI via voice command injection - speak "F5 F5 config F6 F6" to inject {{config}} and leak SECRET_KEY.
$ ls tags/ techniques/
flasksstipythonspeech_to_textserver_side_template_injectionjinja2werkzeugvoice_command_injectionwav_uploadgttskeycodesaudio_payload
Server-Side Template Injection (SSTI) via speech-to-textVoice command injection through WAV file uploadKeyCodes bypass for special characters injectionFlask config disclosure via {{config}}
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub, then upgrade to Pro.
$ssh [email protected]