VirtualEscape

SCENARIO

You've been granted access to a web application that renders custom templates. It looks simple. The developers were careful they read the right articles and put protections in place.  They were almost right.  Somewhere between what the application accepts and what it ultimately executes, there is a gap. Not in a library, not in the server but in the developer's mental model of their own defenses.  Trace the journey your input takes from entry to output. Somewhere along that path, the rules break down. The flag is on the server. The key is hiding in plain sight.

Flag format: flag{}

Infrastructure

- Docker Container — HTTP on port 3000

Provided Files

- virtualescape-2069.zip (4.8 KB)