mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-14 17:07:34 +00:00
GITBOOK-3895: change request with no subject merged in GitBook
This commit is contained in:
parent
7f33a88918
commit
7bb967cca9
1 changed files with 1 additions and 1 deletions
|
@ -257,7 +257,7 @@ app.secret_key = '(:secret:)'
|
|||
|
||||
In this scenario you need a gadget to traverse files to get to the main one to **access the global object `app.secret_key`** to change the Flask secret key and be able to [**escalate privileges** knowing this key](../../network-services-pentesting/pentesting-web/flask.md#flask-unsign).
|
||||
|
||||
A payload like this one:
|
||||
A payload like this one [from this writeup](https://ctftime.org/writeup/36082):
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```python
|
||||
|
|
Loading…
Reference in a new issue