webPromedium

Museum

hackerlab

Task: a Flask museum site with registration, profiles, and an admin review bot hid the real attack surface behind a public user page. Solution: exploit stored XSS in profile_name, leak the bot pathname, enumerate /user/<id>, read /documents through the bot, recover admin credentials, and open /admin.

$ ls tags/ techniques/
flaskstored_xssadmin_botprofile_namehidden_routecredential_disclosure
stored_xss_context_exfiltrationpublic_profile_enumerationsame_origin_form_exfiltration
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups