webPromedium

Bad Apple

tamuctf

A Flask web app that converts uploaded videos/GIFs to frames using ffmpeg, with Apache serving files. The challenge name "Bad Apple" is a famous Touhou reference. The goal is to retrieve a flag hidden in a GIF file that is protected by HTTP Basic Auth.

$ ls tags/ techniques/
flaskpath_traversalfile_uploadapacheidordirectory_listingauth_bypassffmpeggif_to_frames
visual_flag_extractiondirectory_listing_exploitationinput_sanitization_bypassauth_bypass_via_format_conversion
πŸ”’

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups