b6a.black/posts/2020-07-22-uiuctf-deserializeme

Preview meta tags from the b6a.black website.

Linked Hostnames

6

Search Engine Appearance

Google

https://b6a.black/posts/2020-07-22-uiuctf-deserializeme

UIUCTF 2020: deserializeme

Update: It was assigned as CVE-2020-14343 after the contest. This was a fun challenge exploiting a deserialize service in Python. The server is using pyYAML and Flask, with the source code below: from flask import Flask, session, request, make_response import yaml import re import os app = Flask(__name__) app.secret_key = os.urandom(16) @app.route('/', methods=["POST"]) def pwnme(): if not re.fullmatch(b"^[\n --/-\]a-}]*$", request.data, flags=re.MULTILINE): return "Nice try!", 400 return yaml.load(request.data) if __name__ == '__main__': app.



Bing

UIUCTF 2020: deserializeme

https://b6a.black/posts/2020-07-22-uiuctf-deserializeme

Update: It was assigned as CVE-2020-14343 after the contest. This was a fun challenge exploiting a deserialize service in Python. The server is using pyYAML and Flask, with the source code below: from flask import Flask, session, request, make_response import yaml import re import os app = Flask(__name__) app.secret_key = os.urandom(16) @app.route('/', methods=["POST"]) def pwnme(): if not re.fullmatch(b"^[\n --/-\]a-}]*$", request.data, flags=re.MULTILINE): return "Nice try!", 400 return yaml.load(request.data) if __name__ == '__main__': app.



DuckDuckGo

https://b6a.black/posts/2020-07-22-uiuctf-deserializeme

UIUCTF 2020: deserializeme

Update: It was assigned as CVE-2020-14343 after the contest. This was a fun challenge exploiting a deserialize service in Python. The server is using pyYAML and Flask, with the source code below: from flask import Flask, session, request, make_response import yaml import re import os app = Flask(__name__) app.secret_key = os.urandom(16) @app.route('/', methods=["POST"]) def pwnme(): if not re.fullmatch(b"^[\n --/-\]a-}]*$", request.data, flags=re.MULTILINE): return "Nice try!", 400 return yaml.load(request.data) if __name__ == '__main__': app.

  • General Meta Tags

    13
    • title
      UIUCTF 2020: deserializeme | Black Bauhinia
    • charset
      utf-8
    • X-UA-Compatible
      IE=edge
    • viewport
      width=device-width, initial-scale=1, shrink-to-fit=no
    • robots
      index, follow

  • Open Graph Meta Tags

    4
    • og:title
      UIUCTF 2020: deserializeme
    • og:description
      Update: It was assigned as CVE-2020-14343 after the contest. This was a fun challenge exploiting a deserialize service in Python. The server is using pyYAML and Flask, with the source code below: from flask import Flask, session, request, make_response import yaml import re import os app = Flask(__name__) app.secret_key = os.urandom(16) @app.route('/', methods=["POST"]) def pwnme(): if not re.fullmatch(b"^[\n --/-\]a-}]*$", request.data, flags=re.MULTILINE): return "Nice try!", 400 return yaml.load(request.data) if __name__ == '__main__': app.
    • og:type
      article
    • og:url
      https://b6a.black/posts/2020-07-22-uiuctf-deserializeme/

  • Twitter Meta Tags

    3
    • twitter:card
      summary
    • twitter:title
      UIUCTF 2020: deserializeme
    • twitter:description
      Update: It was assigned as CVE-2020-14343 after the contest. This was a fun challenge exploiting a deserialize service in Python. The server is using pyYAML and Flask, with the source code below: from flask import Flask, session, request, make_response import yaml import re import os app = Flask(__name__) app.secret_key = os.urandom(16) @app.route('/', methods=["POST"]) def pwnme(): if not re.fullmatch(b"^[\n --/-\]a-}]*$", request.data, flags=re.MULTILINE): return "Nice try!", 400 return yaml.load(request.data) if __name__ == '__main__': app.

  • Link Tags

    7
    • canonical
      https://b6a.black/posts/2020-07-22-uiuctf-deserializeme/
    • icon
      https://b6a.black/favicon.ico
    • preconnect
      https://fonts.gstatic.com
    • preload stylesheet
      /assets/css/stylesheet.min.79c4dfee3993cd3110886e38d36a5106e0d6922344cefa3ff5c0076f246815f0.css
    • stylesheet
      https://fonts.googleapis.com/css2?family=Recursive&display=swap

Links

13