Writeups
-
Easy
File path traversal, traversal sequences stripped non-recursively
file path traversal where ../ sequences are stripped in a single pass
Path traversal 2 min -
Easy
File path traversal, traversal sequences blocked with absolute path bypass
file path traversal where ../ sequences are filtered
Path traversal 2 min -
Easy
File path traversal, simple case
file path traversal in a product image endpoint
Path traversal 2 min -
Hard
Server-side template injection with a custom exploit
server side template injection with no public payload, built into a custom exploit by leaking method names from errors, reading source through an avatar based file read, then chaining the app's own setAvatar and gdprDelete to delete carlos's private key
Server-side template injection (SSTI) 5 min -
Hard
Server-side template injection in a sandboxed environment
server side template injection against freemarker locked behind a weak sandbox
Server-side template injection (SSTI) 3 min -
Medium
Server-side template injection with information disclosure via user-supplied objects
server side template injection in a django template used not for code execution but to leak data
Server-side template injection (SSTI) 3 min -
Medium
Server-side template injection in an unknown language with a documented exploit
server side template injection with no engine named, fingerprinted as handlebars with a polyglot fuzz string
Server-side template injection (SSTI) 4 min
Nothing matched that.
No writeups here yet. Try a broader tag, or clear the filter to see everything.
Clear filters