01The idea
Going from finding a vulnerability to passing it on. To build a challenge, you have to understand the flaw well enough for another player to find it without a direct hint.
02The scenario
A portfolio platform accepts SVG logos and "cleans" them before displaying them. The site gives few hints: the lead comes from reconnaissance, just like on a real target.
03Architecture
- A
docker-composesetup with two containers: the target application and an admin bot. - The bot visits the links players report, carrying an admin session cookie. That's the one to trap.
- The report endpoint only accepts certain hostnames and URL formats, so the bot can't be used to attack anything but the challenge.
- Both CVE bypasses are exploitable, not just the first one.
04Status
Work in progress. The solution will obviously not be published here.