0

I am doing a CTF-style assignment and I am confronted with a web site created in Flask. This web site appears fairly unremarkable - it has 4 pages and no log-in/authentication functionality, nor does it have any input elements on any page. However, the one suspicious thing which is also pointed at in the assignment's hints, is the URL. One can visit the website by going to http://URL:port, but then for some reason a parameter is always appended even though nothing suggests that a parameter should be added ie. when I type in http://URL:port, I am taken to the site, but the URL is changed to http://URL:port/?p=index.html. This same format is used for all the other pages eg. http://URL:port/?=example.html.

I have tried doing a variety of simple things like a basic XSS attack, but to no avail. I have no idea what the significance of changing the URL does, though. Why is such a thing inherently insecure? Thanks.

I will also add that this is described as a 'web/linux' challenge, and the task involves getting into the server and obtaining a flag. No source codes are provided whatsoever, and inspection of the HTML elements yields nothing suspicious.

5
  • 1
    Looks like a traversal bug to me Commented Nov 10, 2022 at 11:43
  • Try chaning to ?=/etc/passwd and see what happens Commented Nov 10, 2022 at 15:15
  • @GACy20 @.wireghoul Yes, it turned out to be a traversal bug. I got the file of linux passwords. Apologies for asking another question within a question, but how do I make use of it to search through the server's file system? Thanks. Commented Nov 10, 2022 at 16:40
  • maybe you could see if there was a way to find other open ports .. i wonder if that traversal gives you access to /proc/ Commented Nov 10, 2022 at 18:14
  • @brynk sorry for the late response, but unfortunately /proc/ is one of the banned words - it is hardcoded into the program to reject the URL if it appears. Commented Nov 11, 2022 at 6:13

0

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.