Search for a command to run...
Articles tagged with #flask
Summary A Flask web app accepts a .tar upload of a "git repository" and runs git status and git log against it to display commit stats. Because the tar is extracted with no validation and real git com
Overview Corridor is an easy TryHackMe box built around a single Flask/Werkzeug web app. The homepage presents an image of a corridor with thirteen clickable doors, each linking to a URL that is an MD
Summary The London Bridge is built around a Flask "Explore London" gallery app served behind Gunicorn. A hidden /view_image endpoint takes a form-encoded URL and fetches it server-side - classic SSRF
Summary Recon on <MACHINE_IP> revealed a Gunicorn-hosted "Byte Lotus" hotel site with two paths disallowed in robots.txt - /internal/ and /status. The /status page exposes an internal staff tool ("Sis
Overview The Hollow Shell is a Flask app ("Shoreline Display - Room Service") that lets an authenticated concierge upload themed "shells" as .zip archives. Each archive must contain a shell.json manif
TL;DR Beach Bar is a Flask-based "DJ booth" web app for a beach bar jukebox. Default demo credentials (dj/dj) left enabled in an HTML comment get you into the dashboard, which exposes a YAML playlist
