BrumensYWH

ADMIN

Challenges:

Dojo #43 - CCTV Manager## CCTV Manager Active until : **14th Aug - 2025** **Note: Due to holiday, triage on the Dojo program may be delayed** #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description During a pentest, we discovered a rare custom Linux distro running a CCTV management program that seems to be stuck in a boot process. If we can upload a custom firmware, we should be able to get a remote code execution (RCE) on the CCTV. We leave the rest to you. _~ **Note:** To view the setup code for this challenge, click on settings (**⚙** icon) located at the top over the tab: `INFO`._ ## Goal **BRUTE FORCE IS NOT ALLOWED!** (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (PoC) showing how you obtained the flag - The flag must be included in the report

Last Update: 7/14/2025, 8:21 AM

Dojo #36 - Shell escape# Shell escape - Dojo #36 Active until : **4th November - 2024** Authors: [Owne](https://x.com/__owne__), [Brumens](https://x.com/Brumens2) #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description A friend of yours has created a web application that allows you to check the availability of your locally hosted services. He assured you that it is secure and even allowed you to run it as a test user! Prove him wrong by reading the `flag.txt` file on the server. ~ _The flag can be found in the file: `/tmp/flag.txt`_ ## Goal **BRUTE FORCE IS NOT ALLOWED!** (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (PoC) showing how you obtained the flag - The flag must be included in the report

Last Update: 6/10/2025, 12:36 PM

WAF Bypass - Transformation# WAF Bypass - Transformation # Description The firewall will block a wide range of prefix syntax used in template injection payloads # Goal Bypass the firewall by exploiting the transformation that occurs in the back-end of the vulnerable application.

Last Update: 6/10/2025, 12:36 PM

Dojo #38 - Xmas wishlist# Xmas wishlist Active until : **17th January - 2025** #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description Santa has been busy in recent years. Now you can submit your very own wishlist in TOML format on his new website! Can you make your wish come true? The flag can be found in the enviroment variable: `FLAG` ## Goal **BRUTE FORCE IS NOT ALLOWED!** (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (PoC) showing how you obtained the flag - The flag must be included in the report

Last Update: 6/10/2025, 12:36 PM

Dojo #41 - Ruby treasure# Ruby treasure - Dojo #41 Active until : **29th May - 2025** #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description We're a new development team and we're big fans of Ruby in all its forms. To kick things off, we've launched our brand new online shop: **Ruby treasure**, where we offer our finest fake Ruby jewellery. We've hired some of the best developers around, so feel free to try hacking us - if you dare. _~ The flag can be found in fhe file: `/tmp/flag_**********.txt`*_ ## Goal **BRUTE FORCE IS NOT ALLOWED!** (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (PoC) showing how you obtained the flag - The flag must be included in the report

Last Update: 6/10/2025, 12:36 PM

Dojo #40 - Hacker profile# Hacker profile - Dojo #40 Active until : **17th April - 2025** Authors: [Minilucker](https://x.com/0xidel) #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description Use only JSON to build your hacker profile. The developer claims their application is fully secure. Prove them wrong by reading the `flag.txt` file on the server. ~ _The flag can be found in the enviroment variable: `FLAG`_ ## Goal **BRUTE FORCE IS NOT ALLOWED!** (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (PoC) showing how you obtained the flag - The flag must be included in the report

Last Update: 6/10/2025, 12:36 PM

Dojo #39 - Phishing# Phishing Active until : **28th February - 2025** #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description A new website offers free “phishing” sites, grab yours before it's too late! The flag can be found in the enviroment variables named : `FLAG` ## Goal **BRUTE FORCE IS NOT ALLOWED!** (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (PoC) showing how you obtained the flag - The flag must be included in the report

Last Update: 6/10/2025, 12:36 PM

Exploiting Unknown Syntaxes - Character Name## Exploiting Unknown Syntaxes - Character Name The web application offers an online game where you have to capture the flag and avoid all hidden mines at all costs. will you be able to capture the flag? It seems that this web application is vulnerable to a SSTI (Server-Side Template Injection), but we can't type the dollar sign (`$`) character to exploit it, or can we? Note: _The flag can be found in the environment variable named: `FLAG`_ ## Goal Find a way to exploit a SSTI to perform a Remote Code Execution (RCE) and gain access to the vulnerable web application.

Last Update: 6/10/2025, 12:36 PM

Exploiting Unknown Syntaxes - File scheme## Exploiting Unknown Syntaxes - File scheme The web application offers an online game where you have to capture the flag and avoid all hidden mines at all costs. will you be able to capture the flag? It seems that this web application is not properly validating the given filename from a player. How can we bypass the validation filename check and capture the flag? Note: _The flag can be found in the file: `/tmp/flag.txt`_ ## Goal Find a way to bypass the filename validation filter and read arbitrary files on the vulnerable application and capture the flag!

Last Update: 6/10/2025, 12:36 PM

Dojo #35 - Chatroom# Chatroom - Dojo #35 Active until : **21th September - 2024** #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description The chatroom where all hackers used to hang out was found to contain a serious 0-day vulnerability. There is still no official explanation of how the vulnerability can be exploited, can you figure it out? ~ _The flag can be found in the file: `/tmp/flag.txt`_ ## Goal **BRUTE FORCE IS NOT ALLOWED!** (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (PoC) showing how you obtained the flag - The flag must be included in the report

Last Update: 6/10/2025, 12:36 PM

WAF Bypass - Filter collision# WAF Bypass - Filter collision # Description The firewall will detect a certain amount of patterns, but when the payload is handled by the backend server, the payload will be filtered and modified before being reflected in the response. # Goal Bypass the firewall by exploiting the filter collision.

Last Update: 6/10/2025, 12:36 PM

WAF Bypass - Encoding# WAF Bypass - Encoding # Description The WAF supports a wide range of encodings to detect payloads in different forms # Goal Bypass the WAF by taking advantage of a supported encoding that the WAF can detect but that the vulnerable application does not decode.

Last Update: 6/10/2025, 12:36 PM

Command injection in Python -CWE-78# Command injection in Python - CWE-78 ## Goal Escape the system command `nslookup` in the function `os.popen(...)` and inject your own system command and open the file in the current folder named `flag.txt`!

Last Update: 6/10/2025, 12:36 PM

Basic server side template injection (SSTI) - Python Jinja2# Basic server side template injection (SSTI) - Python Jinja2 Use the knowledge from the training module <a href="/learn/jinja2">jinja2</a> to read the flag located in the system enviroment.

Last Update: 6/10/2025, 12:36 PM

Arbitrary file read through basic Local File Inclusion# Arbitrary file read through basic Local File Inclusion Include a file that allows you to read it. The flag is a step outside the `pages` folder.

Last Update: 6/10/2025, 12:36 PM

Local File Inclusion with insecure filter# Local File Inclusion with insecure filter Infect and include the log file `data.log` to be able to execute PHP code on the target application and perform a remote code execution (RCE). # Goal Read the flag in the environment variables of the vulnerable application.

Last Update: 6/10/2025, 12:36 PM

Local file inclusion to arbitrary file read with PHP wrappers# Local File Inclusion With PHP Wrappers Preform a Local File Inclusion by taking advantage of [PHP's built-in Wrappers](https://www.php.net/manual/en/wrappers.php). You can still use the standard method to read the file, but for educational purposes it is good to know that PHP supports wrappers that can be used to bypass filters and/or web application firewalls (WAF).

Last Update: 6/10/2025, 12:36 PM

Basic Insecure direct object references (IDOR) in cookie# Basic Insecure direct object references (IDOR) in cookie Send JSON data to the application and exploit the poor role verification process to get the flag.

Last Update: 6/10/2025, 12:36 PM

Basic Insecure Deserialization in PHP# Basic Insecure Deserialization in PHP Exploit the insecure deserialization vulnerability and extract the `flag.txt` file located in the current folder.

Last Update: 6/10/2025, 12:36 PM

Dojo #30 - Terminal isolation# Terminal isolation - Dojo #30 Active until : **7th Mars - 2024** #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description Break free from the isolation, get a [**R**emote **C**ode **E**xecution (RCE)](https://www.cloudflare.com/learning/security/what-is-remote-code-execution/) and steal the flag! ~ _The flag can be found in the file : `flag.txt`._ ## Goal > BRUTE FORCE IS NOT ALLOWED! (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (POC) showing how you obtained the flag - The flag must be included in the report

Last Update: 6/10/2025, 12:36 PM

WAF Bypass - Exclude spaces# WAF Bypass - Exclude spaces # Description The WAF will block any request that contains a space, tab or newline # Goal Bypass the firewall by exploiting the SQL injection in the vulnerable application without using any spaces and extract the flag that is set as the admin's note. Note : The FLAG is in the form of : `FLAG{<four_digits>}`

Last Update: 6/10/2025, 12:36 PM

Dojo #31 - Coffee shop# Coffee shop - Dojo #31 Active until : **13th April - 2024** #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description The coffee shop has gone well so far, only one too strong espresso was handed out. I bet that's because we didn't use our own special coffee beans. Anyway, make a review and don't forget to take advantage of our new feature allowing escape characters! ~ _The flag can be found in the enviroment variable: `FLAG`._ ## Goal **BRUTE FORCE IS NOT ALLOWED!** (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (PoC) showing how you obtained the flag - The flag must be included in the report

Last Update: 6/10/2025, 12:36 PM

Dojo #34 - AI Image Generator# AI Image Generator - Dojo #34 Active until : **02th August - 2024** Authors: [Pwnii](https://x.com/pwnwithlove), [Brumens](https://x.com/Brumens2) #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description A new tool has recently been published, designed to generate beautiful AI images based on your given prompt. We have also made sure that it works to upload files if the prompt is in XML format! **Will you be able to find the flag?** ~ _The flag can be found in the file: `/tmp/flag.txt` ## Goal **BRUTE FORCE IS NOT ALLOWED!** (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (PoC) showing how you obtained the flag - The flag must be included in the report

Last Update: 6/10/2025, 12:36 PM

Dojo #33 - Windows 12# Windows 12 - Dojo #33 Active until : **23th June - 2024** #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description We've had the honor of trying out a new computer in the office! Seems we got a nice welcome message when we started the computer, wonder what else there is to find? ~ _The flag can be found in the file: `/tmp/secrets/flag.txt` **Note:** The docker application do not have access to the internet ## Goal **BRUTE FORCE IS NOT ALLOWED!** (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (PoC) showing how you obtained the flag - The flag must be included in the report

Last Update: 6/10/2025, 12:36 PM

Basic IDOR with hash as user identifier# Basic IDOR with hash as user identifier Access the `admin` user that has the id `1` from the `users` list presented in the PHP code.

Last Update: 6/10/2025, 12:36 PM

Dojo #37 - Hacker forum# Hacker forum Active until : **12th December - 2024** #### How to submit your report 1. Visit the Dojo program at [https://yeswehack.com/programs/dojo](https://yeswehack.com/programs/dojo) 2. Click on **submit report** 3. Login or create your account 4. Submit your report --- ## Description A hacking forum has appeared on the internet and is about to go viral. However, it seems that a 0-day has been discovered in the forum, can you exploit it? The flag is the password for the user: `brumens`. > Tip: _Click on the challenge title **HACKER FORUM** to view the setup code._ ## Goal **BRUTE FORCE IS NOT ALLOWED!** (_Applies only to the Dojo challenge page itself._) ### A valid solution for the challenge must meet these requirements: - Your report must include a proof of concept (PoC) showing how you obtained the flag - The flag must be included in the report

Last Update: 6/10/2025, 12:36 PM

Insecure deserialization - Python pickle# Insecure deserialization - Python pickle Exploit the insecure deserialization process made by the function `pickle.loads()` to archive a remote code execution (RCE) on the target system. Use the RCE to extract the flag which is located in the system enviroment variables. #### Be aware ~ _The second hint gives the exploitation code to create serialized payloads that can execute system commands on the target_

Last Update: 6/10/2025, 12:36 PM

Exploiting Unknown Syntaxes - parse_url## Exploiting Unknown Syntaxes - parse_url The web application offers an online game where you have to capture the flag and avoid all hidden mines at all costs. will you be able to capture the flag? **Note:** _You can solve this challenge by just infecting a host other than `localhost`, but for a full solution, try popping an `alert` by exploiting the XSS vulnerability._ ## Goal Find a way to infect the application's script tag with your host and exploit a Cross Site Scripting (XSS) to capture the flag.

Last Update: 6/10/2025, 12:36 PM