webProeasy
Lab 384 — DevPulse — RCE via AI Log Assistant Prompt Injection
hackadvisor
Task: Server monitoring platform with AI-powered log analysis assistant that supports direct OS command execution via 'run:' prefix. Solution: Used the assistant's documented 'run: env' command to read environment variables containing the flag.
$ ls tags/ techniques/
flaskdockerrcecommand_executionnginxlog_analysisprompt_injectionenvironment_variablealpine_linuxhoneypot_flagaiai_assistant
environment_variable_disclosurehoneypot_flag_detectionai_assistant_command_injectiondirect_command_execution_via_run_prefix
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 59 — NetPulse — RCE via Command Injection in Network Diagnostics— hackadvisor
- [web][Pro]Lab 322 — NetPulse — IP Spoofing to RCE via Polling Agent API— hackadvisor
- [web][Pro]Lab 120 — InfraPulse— hackadvisor
- [web][Pro]Lab 104 — CloudOps Copilot — AI SSRF via Infrastructure Tool Abuse— hackadvisor
- [web][Pro]Lab 56 — DataPulse — XXE to SSRF via SVG Avatar Upload— hackadvisor