Noter

$ tldr JWT Flask-Unsign → md-to-pdf 4.1.0 RCE → privesc

·	·
Operating system	Linux
Difficulty	Medium
Vector	Web
IP	`10.10.11.160`
Retirement date	2022-09-28
Skills	Information Leakage - User Enumeration [Brute-Force Wfuzz] Finding valid users - Wfuzz SSTI (Server Side Template Injection) [Failed] JWT Enumeration Abusing JWT - Flask-Unsign Cracking Flask Cookie Secret - Flask-Unsign Cookie Hijacking FTP Enumeration Information Leakage in PDF document Finding a command injection in the web RCE in md-to-pdf 4.1.0 Abusing the vulnerable code definition - Alternative Command Injection (RCE) Abusing MYSQL service running as the root user [Privilege Escalation] (raptor_udf2.so)

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇪🇸 ES	El Pingüino de Mario	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
SSTI (Server-Side Template Injection)	PortSwigger	Open
Information Leakage	HackTricks	Open
OS Command Injection	PortSwigger	Open
Directory fuzzing	HackTricks	Open
Remote Code Execution (RCE)	HackTricks	Open
JSON Web Tokens (JWT)	PortSwigger	Open

Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07