Portfolio

This is a Server Side Template Injection Challenge.

URL = http://folio.sunshinectf.org/

Given link contains a page with two links. - Custom greeting - Dynamic page rendering

If we go to Custom greeting [http://folio.sunshinectf.org/hello/name] which has Hello name! Welcome to world of Flask., which tells us that it is a python flask server. If we change the name to some other name like http://folio.sunshinectf.org/hello/Ak we get Hello Ak! Welcome to world of Flask. which means the last part of the url is kept in the source code.

Hmm.. Now I tried to give http://folio.sunshinectf.org/hello/{{7*7}} and hope it would give Hello 49!, But no use :(

Then I went to Dynamic page rendering [http://folio.sunshinectf.org/render.html] which has a form which posts data template=/template/matches.html and template=/template/teams.html and we can also access template=/template/admin.html.

But visiting these sites is of no use. If we visit admin.html we can see {% if config.DEBUG %} {{config.FLAG}} {% endif %} Hi there! But if we post that as value to template in render, we can see the {{}} parts are evaluated. And the flag is in the properties of config variable.

Now I tried to send /hello/{{7*7}} as value of template to render.html and it worked and returned Hello 49! Welcome to world of Flask.. Now I tried to print the properties of config variable and it contains the flag.

Flag is sun{5l33333p_15_f0r_7h3_w34k}