All rooms Sign in
WEBLesson + challenge Live machinePremium

Deserialized Dreams

A dreamy little journaling app with one URL too many — follow the loopback into its unguarded inner life.

A dreamy little journaling app with one URL too many — follow the loopback into its unguarded inner life.

Difficulty
Hard
Estimated time
45 min
Points
400 pts
Completions
Be the first to complete it
Authors
By Cyber Academy 4 U
Create a free account to startSign in

What you will learn

  • Server-Side Request Forgery (SSRF) and bypassing a naive host blocklist to reach loopback-only services (OWASP A10).
  • Discovering and fingerprinting an internal, unpublished HTTP service through an SSRF oracle.
  • Insecure deserialization of Python `pickle` and writing a `__reduce__` RCE gadget by hand (OWASP A08).
  • Chaining an access flaw into code execution and exfiltrating output through the only channel you have.

What is inside

  1. Task 1 · Deserialized Dreams1 question

Sign in to read the tasks, start the machine and answer the questions.