webeasy

Broken Box

hackerlab

Task: a Flask/Werkzeug SVG-to-PNG converter accepted raw XML and stored the rendered image at /static/data.png. Solution: exploit XXE in the SVG parser to load file:///flag.txt, render the file contents inside the generated PNG, and verify the result with repeated OCR after correcting an initial xmi/xml misread.

$ ls tags/ techniques/
flaskfile_readwerkzeugocrxxesvgxml
xxe_file_readsvg_entity_injectionlocal_file_disclosureocr_validation
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]