Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag
All challengesIn progress
Web-30. Insecure Deserialization in KinoVault
Mission
A legacy backup system codenamed KinoVault reportedly serializes user session objects with Python's pickle module and stores them in a cookie. Analyze the cookie format and investigate whether a crafted pickle payload can escalate privileges.
Not started
Hints
Hint 1Show
Python's pickle module is not safe against untrusted input
Hint 2Show
A class's __reduce__ method can define what runs during unpickling
Hint 3Show
Simply crafting a User object with role='admin' directly may be enough to solve this