A Flask page that appends the submitted text to a file with os.system('echo ...'). The response is always the same WELCOME! message.
Pas commencéDockercommit a9051cfx86_64 · aarch64Secret
Inject a shell command through the text field and prove it ran, without seeing its output in the page (blind OS command injection).
Le brief de ce lab se trouve dans son dépôt.