live-ctf/livectf-defcon30

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/aes-of-spades/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/f-in-the-stack/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/loopy-brain/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/nerd-sniped/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/no-roplem/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/nvulns/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/open-to-interpretation/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/over-easy/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/pacman/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/seek-and-destroy/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/nopcoding/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/stacks/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/story-time/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  challenges/syscall-me-maybe/challenge/config.toml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/aes-of-spades/solution/Pipfile.lock
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/aes-of-spades/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/f-in-the-stack/solution/Pipfile.lock
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/f-in-the-stack/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/fairy-nuff/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/fast-updater/solution/Pipfile.lock
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/fast-updater/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/loopy-brain/solution/Pipfile.lock
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/loopy-brain/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/nerd-sniped/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/no-roplem/solution/Pipfile.lock
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/no-roplem/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/nopcoding/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/nvulns/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/open-to-interpretation/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/over-easy/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/pacman/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/quick-cast/solution/Pipfile.lock
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/quick-cast/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/seek-and-destroy/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/stacks/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/story-time/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  challenges/syscall-me-maybe/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious CVE-2020-28468 pwntools Server-Side Template Injection (SSTI) vulnerability
  template/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Worth fixing GHSA-f85w-wvc7-crwc bumpalo has use-after-free due to a lifetime error in `Vec::into_iter()`
  base-image/submitter/Cargo.lock
  A package you depend on has a known security hole (GHSA-f85w-wvc7-crwc). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/aes-of-spades/solution/Pipfile.lock
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/aes-of-spades/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/f-in-the-stack/solution/Pipfile.lock
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/f-in-the-stack/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/fairy-nuff/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/fast-updater/solution/Pipfile.lock
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/fast-updater/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/loopy-brain/solution/Pipfile.lock
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/loopy-brain/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/nerd-sniped/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/no-roplem/solution/Pipfile.lock
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/no-roplem/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/nopcoding/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/nvulns/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/open-to-interpretation/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/over-easy/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/pacman/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/quick-cast/solution/Pipfile.lock
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/quick-cast/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/seek-and-destroy/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/stacks/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/story-time/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/challenges/syscall-me-maybe/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Serious PYSEC-2021-72 This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code exe
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/template/solution/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28468). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2024-0332 Degradation of service in h2 servers with CONTINUATION Flood
  /workdirs/scan-d9958c3c-3451-476c-9257-4f6fb6d04071/base-image/submitter/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0