Skip to content
Dojo challenge #50 Bucket Vault solution
yeswehack.com | blog | #cloud-security | #pentesting | #ctf | #web-security | #path-traversal | #dojo | #yeswehack | #hmac | #presigned-url
Summary
Dojo #50: smuggling control characters past the '..' check — stripped only before HMAC signing — lets hunters forge a presigned URL and read a protected file outside the public/ prefix.
- Published
- Collected