webPromedium
Lab 63 — DataPulse — Insecure Deserialization via Preferences Cookie
hackadvisor
Task: DataPulse analytics dashboard with workspace preferences persisted in a base64-encoded cookie that is deserialized server-side using node-serialize's unserialize(). Solution: Inject _$$ND_FUNC$$_ IIFE payload into the preferences cookie to achieve RCE via child_process.execSync, reading /root/flag.txt.
$ ls tags/ techniques/
rcenodejsbase64expressinsecure_deserializationcookie_tamperinghoneypot_flagnode_serializeiifechild_processpreferences_cookie
honeypot_flag_identificationnode_serialize_unserialize_iifend_func_function_injectioncommand_execution_via_child_process_execsynccookie_tampering_base64_encoded_payload
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 56 — DataPulse — XXE to SSRF via SVG Avatar Upload— hackadvisor
- [web][Pro]Lab 59 — NetPulse — RCE via Command Injection in Network Diagnostics— hackadvisor
- [web][Pro]DevPulse — CSRF via JSON Content-Type Bypass— hackadvisor
- [web][Pro]Lab 186 — DataPulse — CORS Origin Validation Bypass— hackadvisor
- [web][Pro]Lab 169 — GridPulse — Insecure Deserialization via Configuration Import— hackadvisor