Brumens

ADMIN

Challenges:

Dojo #31 - Coffee shop# Coffee shop - Dojo #31 Active until : **13th April - 2024** #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description The coffee shop has gone well so far, only one too strong espresso was handed out. I bet that's because we didn't use our own special coffee beans. Anyway, make a review and don't forget to take advantage of our new feature allowing escape characters! ~ _The flag can be found in the enviroment variable: `FLAG`._ ## Goal **BRUTE FORCE IS NOT ALLOWED!** (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (PoC) showing how you obtained the flag - The flag must be included in the report

Last Update: 3/13/2024, 1:29 PM

Dojo #30 - Terminal isolation# Terminal isolation - Dojo #30 Active until : **7th Mars - 2024** #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description Break free from the isolation, get a [**R**emote **C**ode **E**xecution (RCE)](https://www.cloudflare.com/learning/security/what-is-remote-code-execution/) and steal the flag! ~ _The flag can be found in the file : `flag.txt`._ ## Goal > BRUTE FORCE IS NOT ALLOWED! (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (POC) showing how you obtained the flag - The flag must be included in the report

Last Update: 2/7/2024, 2:22 PM

Command injection in Python -CWE-78# Command injection in Python - CWE-78 ## Goal Escape the system command `nslookup` in the function `os.popen(...)` and inject your own system command and open the file in the current folder named `flag.txt`!

Last Update: 2/6/2024, 2:03 PM

Local file inclusion to arbitrary file read with PHP wrappers# Local File Inclusion With PHP Wrappers Preform a Local File Inclusion by taking advantage of [PHP's built-in Wrappers](https://www.php.net/manual/en/wrappers.php). You can still use the standard method to read the file, but for educational purposes it is good to know that PHP supports wrappers that can be used to bypass filters and/or web application firewalls (WAF).

Last Update: 2/6/2024, 2:00 PM

Basic Insecure direct object references (IDOR) in cookie# Basic Insecure direct object references (IDOR) in cookie Send JSON data to the application and exploit the poor role verification process to get the flag.

Last Update: 2/6/2024, 2:00 PM

Arbitrary file read through basic Local File Inclusion# Arbitrary file read through basic Local File Inclusion Include a file that allows you to read it. The flag is a step outside the `pages` folder.

Last Update: 2/6/2024, 1:56 PM

Basic Insecure Deserialization in PHP# Basic Insecure Deserialization in PHP Exploit the insecure deserialization vulnerability and extract the `flag.txt` file located in the current folder.

Last Update: 2/6/2024, 1:47 PM

Local File Inclusion with insecure filter# Local File Inclusion with insecure filter Infect and include the log file `data.log` to be able to execute PHP code on the target application and perform a remote code execution (RCE). # Goal Read the flag in the environment variables of the vulnerable application.

Last Update: 2/6/2024, 1:46 PM

Basic server side template injection (SSTI) - Python Jinja2# Basic server side template injection (SSTI) - Python Jinja2 Use the knowledge from the training module <a href="/learn/jinja2">jinja2</a> to read the flag located in the system enviroment.

Last Update: 2/6/2024, 1:38 PM

Basic IDOR with hash as user identifier# Basic IDOR with hash as user identifier Access the `admin` user that has the id `1` from the `users` list presented in the PHP code.

Last Update: 1/22/2024, 1:51 PM

Insecure deserialization - Python pickle# Insecure deserialization - Python pickle Exploit the insecure deserialization process made by the function `pickle.loads()` to archive a remote code execution (RCE) on the target system. Use the RCE to extract the flag which is located in the system enviroment variables. #### Be aware ~ _The second hint gives the exploitation code to create serialized payloads that can execute system commands on the target_

Last Update: 1/19/2024, 2:13 PM