https://th3b0ywh0l1v3d.github.io/tags/environment-variables/ Recent content in Environment-Variables on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/zer0d4yh31st/web/la-casa-de-papel/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/zer0d4yh31st/web/la-casa-de-papel/ A Flask/Jinja2 app renders user-supplied names directly into a template, enabling SSTI that dumps os.environ to leak the flag stored as an environment variable.