Exploiting Java Tomcat With a Crazy JSP Web Shell - Real World CTF 2022

This was a hard web CTF challenge involving a JSP file upload with very restricted character sets. We had to use the Expression Language (EL) to construct useful primitives and upload an ascii-only .jar file.

Alternative writeups: https://github.com/voidfyoo/rwctf-4th...
Fuzzing log4j with Jazzer: Fuzzing Java to Find Log4j Vulnerabil...

=[ ❤️ Support ]=

→ per Video: Patreon: liveoverflow
→ per Month: @liveoverflow

=[ 🐕 Social ]=

→ Twitter: Twitter: LiveOverflow
→ Instagram: Instagram: LiveOverflow
→ Blog: https://liveoverflow.com/
→ Subreddit: Reddit: LiveOverflow
→ Facebook: Facebook: LiveOverflow

• #education
• #live_overflow
• #liveoverflow
• #hacking_tutorial
• #how_to_hack
• #exploit_tutorial
• #real_world_ctf
• #realworld_ctf
• #jsp_shell
• #web_shell
• #tomcat
• #rootwar
• #webxml
• #ctf
• #capture_the_flag
• #desperate_cat
• #md5
• #java
• #jdk
• #jvm
• #docker