Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Web-30. Insecure Deserialization in KinoVault
Mission
A legacy backup system codenamed KinoVault reportedly serializes user session objects with Python's pickle module and stores them in a cookie. Analyze the cookie format and investigate whether a crafted pickle payload can escalate privileges.
Hints
Hint 1 Show
Python's pickle module is not safe against untrusted input
Hint 2 Show
A class's __reduce__ method can define what runs during unpickling
Hint 3 Show
Simply crafting a User object with role='admin' directly may be enough to solve this