webProhard
Minefield
hackerlab
Task: Flask minefield game with balloon parameter. Solution: SSTI in render_template_string() allows RCE via reverse shell to retrieve flag.
$ ls tags/ techniques/
ssti_flaskrender_template_string_injectionblind_rcereverse_shell
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Странный сервер (Strange Server)— hackerlab
- [web][Pro]Simple Web (d5c47306-5d4f-4ad4-958f-5414a0b85b9b)— hackerlab
- [web][Pro]Состояние 0x7F— hackerlab
- [web][Pro]Конвертер (Converter)— hackerlab
- [web][Pro]Lab 237 — MailCraft — SSTI in Email Template Preview— hackadvisor