Blog
Into the Skies
#Web Exploit#AWS#SSRF#Metadata#Cloud Security#Terraform
In this blog post, we will explore a web challenge called “Into the Skies” that highlights a server-side request forgery (SSRF) attack in a web application via HTML injection to leak AWS EC2 instance metadata. The challenge begins with a web application that allows users to upload information about their boarding pass, and the application generates a PDF file with the boarding pass information. One of the information entries is an image upload via URL, which the application fetches and displays in the PDF. The challenge is to upload a boarding pass with an image that triggers an SSRF attack to leak AWS EC2 instance metadata.
June 18, 2025
Escape The Flight Simulator
#Container Security#Docker#Docker Escape
In this blog post, we will explore a challenge from MetaCTFv6 called “Escape the Flight Simulator”. The challenge involves exploiting a distroless Docker image to read files from the container without having shell access. This is a common scenario in container security where attackers may try to gain unauthorized access to sensitive information within a containerized environment.
June 18, 2025