webPromedium
Lab 13 — WebForge — Insecure Deserialization in Config Import
hackadvisor
Task: Flask DevOps platform with config import/export using Python pickle serialization. Solution: Craft malicious pickle payload with __reduce__ method to achieve RCE and read /tmp/flag.txt.
$ ls tags/ techniques/
insecure_pickle_deserializationrce_via_reduce_methodbase64_payload_injectionpython_eval_execution
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 116 — InsightForge — IDOR via Undocumented Internal API— hackadvisor
- [web][Pro]Lab 127 — PulseMetric — Insecure Deserialization via Pickle in Agent Report API— hackadvisor
- [web][Pro]TeamForge — IDOR to Owner Account Takeover via Weak Passwords— hackadvisor
- [web][Pro]Lab 205 — DockForge — SSRF in Webhook Test Endpoint— hackadvisor
- [web][Pro]BillForge— hackadvisor