webProhard
В поисках капибары — Hackerlab
hackerlab
Task: Flask web app with login form. Solution: SSTI via Jinja2 with WAF bypass using {%print()%} syntax, hex-escaped __globals__, and lipsum gadget to achieve RCE.
$ ls tags/ techniques/
ssti_jinja2hex_escape_bypasslipsum_gadgetattr_filter_chain
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Состояние 0x7F— hackerlab
- [web][Pro]Джарвис (Jarvis)— hackerlab
- [web][Pro]Странный сервер (Strange Server)— hackerlab
- [web][Pro]Simple Web (d5c47306-5d4f-4ad4-958f-5414a0b85b9b)— hackerlab
- [web][Pro]Квантовый прорыв (Quantum Breakthrough)— hackerlab