Bobby's Bistro

hackthebox

Task: Flask app with SQLite SQLAlchemy, RS256 JWT via PyJWKClient, Chameleon page templates, and an admin bot. Solution: chain SQLi (UNION dump of admin row) + path-traversal arbitrary file write to overwrite the server JWKS, forge an admin JWT, then Chameleon SSTI with a chr()/getattr() char-filter bypass to read /flag.txt.