Company
Date Published
Author
Giovanni Funchal
Word count
1138
Language
English
Hacker News points
None

Summary

The Roadrunner challenge from Snyk's 2022 Fetch the Flag competition is an escape room-style puzzle that involves exploiting an input validation vulnerability in a Go code playground. The challenge starts with access to a webpage where users can type and run Go code, which is then executed by a backend service. The goal is to read the contents of a file located at the root directory of the deployed image. The solution involves using a tainted input to exploit the vulnerability in the script sanitization step, which allows the user to capture the flag.txt file. The challenge requires knowledge of Go programming and understanding of the internal workings of the application, but it is solvable with careful construction of the input and some online research.