Lab 379 — CrawlBase — Stored XSS to SSRF to Pickle Deserialization RCE

hackadvisor

Task: Flask web scraping platform with demo request form, admin bot, PycURL crawl worker supporting gopher://, and Redis-cached pickle-serialized job metadata. Solution: Chain stored XSS (Jinja2 |safe) → SSRF via gopher:// to Redis → inject malicious pickle into job metadata → trigger pickle.loads() for RCE → exfiltrate flag via demo request status update.