A Flask page that appends the submitted text to a file with os.system('echo ...'). The response is always the same WELCOME! message.
Not startedDockercommit a9051cfx86_64 · aarch64Secret
Inject a shell command through the text field and prove it ran, without seeing its output in the page (blind OS command injection).
The brief for this lab lives in its repository.