ما ستتعلّمه
- Confirming and exploiting Server-Side Template Injection in Jinja2 (OWASP A03 — Injection).
- Defeating a keyword/character blacklist that even blocks `.` and `_` in the watched field.
- Using Jinja `|attr()` and `[...]` getitem (which falls back to getattr) in place of dotted access.
- Smuggling forbidden tokens through un-inspected request parameters to reach a reliable RCE gadget.
ماذا تتضمّن
- المهمة 1 · Template Trapسؤال واحد
سجّل الدخول لقراءة المهام وتشغيل الجهاز والإجابة عن الأسئلة.