Dojo challenge #50 Bucket Vault solution
yeswehack.com | blog | #cloud-security | #pentesting | #ctf | #web-security | #path-traversal | #dojo | #yeswehack | #hmac | #presigned-url
Summary
Dojo #50: smuggling control characters past the '..' check — stripped only before HMAC signing — lets hunters forge a presigned URL and read a protected file outside the public/ prefix.
- Published
- Collected
--- id: 4692 title: "Dojo challenge #50 Bucket Vault solution" source_domain: yeswehack.com source_url: "https://www.yeswehack.com/dojo/dojo-challenge-solution-50" published_at: "2026-04-29 07:25" tags: ["cloud-security", "pentesting", "ctf", "web-security", "path-traversal", "dojo", "yeswehack", "hmac", "presigned-url"] phying_url: "https://phying.com/item/4692" lang: en --- # Dojo challenge #50 Bucket Vault solution ## Summary Dojo #50: smuggling control characters past the '..' check — stripped only before HMAC signing — lets hunters forge a presigned URL and read a protected file outside the public/ prefix. ## Intelligence Metadata - **Sources:** yeswehack.com - **Published:** 2026-04-29 07:25 - **Original:** https://www.yeswehack.com/dojo/dojo-challenge-solution-50 - **Phying News:** https://phying.com/item/4692