webProhard
Lab 379 — CrawlBase — Stored XSS to SSRF to Pickle Deserialization RCE
hackadvisor
Task: Flask web scraping platform with demo request form, admin bot, PycURL crawl worker supporting gopher://, and Redis-cached pickle-serialized job metadata. Solution: Chain stored XSS (Jinja2 |safe) → SSRF via gopher:// to Redis → inject malicious pickle into job metadata → trigger pickle.loads() for RCE → exfiltrate flag via demo request status update.
$ ls tags/ techniques/
flaskssrfrcestored_xsspickledeserializationadmin_botredisresp_protocolgopherpycurljinja2_safe_filtercrawl_workermulti_stage_exploit
stored_xss_via_jinja2_safe_filterssrf_via_gopher_protocolredis_cache_poisoning_via_resppickle_deserialization_rce_via_reducedata_exfiltration_via_application_featuremulti_stage_xss_chain
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 362 — LogPulse — Insecure Deserialization via Pickle Session Cookie— hackadvisor
- [web][free]SecretPickle— gpnctf
- [web][Pro]Lab 13 — WebForge — Insecure Deserialization in Config Import— hackadvisor
- [web][free]Secure Secretpickle— gpnctf
- [web][Pro]Dosie X (Dossier X)— hackerlab