Writeups
-
Easy
Method-based access control can be circumvented
method based access control bypass where the admin check only guards POST requests, circumvented by resending the promote action as a GET with a non admin session to upgrade your own account
Access control 3 min -
Easy
URL-based access control can be circumvented
url based access control bypass where a front end blocks /admin but the back end trusts the X-Original-URL header
Access control 3 min -
Easy
File path traversal, validation of file extension with null byte bypass
file path traversal where the app requires an image file extension
Path traversal 2 min -
Easy
File path traversal, validation of start of path
file path traversal where the app validates only that the path starts with the expected folder
Path traversal 2 min -
Easy
File path traversal, traversal sequences stripped with superfluous URL-decode
file path traversal where traversal sequences are blocked
Path traversal 2 min -
Easy
File path traversal, traversal sequences stripped non-recursively
file path traversal where ../ sequences are stripped in a single pass
Path traversal 2 min -
Easy
File path traversal, traversal sequences blocked with absolute path bypass
file path traversal where ../ sequences are filtered
Path traversal 2 min
Nothing matched that.
No writeups here yet. Try a broader tag, or clear the filter to see everything.
Clear filters