Root Me : plateforme d'apprentissage dédiée au Hacking et à la Sécurité de l'Information

Ruby on Rails - ransack

koma — 2025-06-23T18:18:28Z

Find the administrator password.

Nginx - Alias Misconfiguration

.Yo0x — 2024-09-27T12:02:37Z

Our company's web developer has finished developing the new intranet.
Mission : You must assess the security of this site before it goes live.

- Web - Server

Nginx - Root Location Misconfiguration

.Yo0x — 2024-09-27T12:02:34Z

Our web developer tells us that the intranet he has developed is secure because it contains very few functionalities. Prove him wrong by reading the server configuration.

server {
listen 80;
server_name _;
root /etc/nginx;
location = / {
return 302 /login/login.html;
}
location /login/ {
alias /usr/share/nginx/html/login/;
}
location /static/ {
alias /var/www/app/static/;
}
location / {
try_files $uri $uri/ =404;
default_type text/plain;
}
error_page 404 =200 /error.txt;
location /error.txt {
internal;
}
}

Télécharger

- Web - Server

Nginx - SSRF Misconfiguration

.Yo0x — 2024-09-27T12:02:29Z

A developer has added a new feature to his website. He doesn't understand why it's dangerous, and thinks he's filtered the entries correctly. Prove him wrong !

Here is the Nginx configuration used :

server {
listen 80;
root /var/www/app/;
resolver 127.0.0.11 ipv6=off;
location / {
root /var/www/app/login/;
try_files $uri $uri/login.html $uri/ =404;
}
location /static/ {
alias /var/www/app/static/;
}
location /uploads/ {
allow 127.0.0.1;
deny all;
autoindex on;
alias /var/www/app/uploads/;
}
location ~ /dir_enum(.*) {
proxy_pass http://web-serveur-ch94-apache$1;
proxy_redirect off;
}
}

Télécharger

- Web - Server

Python - dotenv

jrjgjk — 2024-09-27T12:02:26Z

A new application is being developed. A white-box audit is necessary before going into production, and you volunteered.

The application offers very few features.
Will you be able to access the admin area and retrieve the server's secrets ?

Don't forget to read the sources !

- Web - Server

API - Broken Access 2

Nishacid , Mika — 2024-01-18T10:59:50Z

After the dismal failure of his previous platform, your friend has come back to you. This time, security has been put in place to prevent you from reading other people's notes, unless someone has shared their secret with you, allowing you to do so with their permission. No more access control vulnerabilities (or not). Show him that his enthusiasm will be short-lived and that the devil is in the detail.

- Web - Server

API - Mass Assignment

Nishacid , Mika — 2024-01-18T10:59:42Z

Your friend thanks you for your previous vulnerability report, and assures you that this time he has removed the possibility of accessing notes, and has even created an administration role !

- Web - Server

API - Broken Access

Nishacid , Mika — 2024-01-18T10:59:32Z

Your friend has set up a platform where you can register and post a private note. Everything is based on an API. Before setting up the Front-End, he asked you to check that everything was secure.

- Web - Server

Java - Custom gadget deserialization

Elweth — 2023-12-28T09:58:36Z

Root-Me has deployed a new connection interface reserved exclusively for administrators.
In view of all the vulnerabilities present on the web, the developer decided to implement the protections himself.

He's so convinced of the robustness of the safeguards he's implemented that he's given you the application's source code.

Sources to download : https://static.root-me.org/web-serveur/ch87/ch87.zip

- Web - Server

Flask - Unsecure session

Sanlokii — 2023-11-29T11:00:46Z

Flask-me's web developer tells you that using a strong secret key is useless. Prove him wrong !

- Web - Server