---
id: 4692
title: "Dojo challenge #50 Bucket Vault solution"
source_domain: yeswehack.com
source_url: "https://www.yeswehack.com/dojo/dojo-challenge-solution-50"
published_at: "2026-04-29 07:25"
tags: ["cloud-security", "pentesting", "ctf", "web-security", "path-traversal", "dojo", "yeswehack", "hmac", "presigned-url"]
phying_url: "https://phying.com/item/4692"
lang: en
---

# Dojo challenge #50 Bucket Vault solution

## Summary

Dojo #50: smuggling control characters past the '..' check — stripped only before HMAC signing — lets hunters forge a presigned URL and read a protected file outside the public/ prefix.

## Intelligence Metadata

- **Sources:** yeswehack.com
- **Published:** 2026-04-29 07:25
- **Original:** https://www.yeswehack.com/dojo/dojo-challenge-solution-50
- **Phying News:** https://phying.com/item/4692