Smoke Test Challenge

Live submissions what the tool sent during the run

• flag accepted EF{0d3c1c487424f653f510ca634e59c85b} 7:07:55 PM
• flag accepted EF{fd837efb99b1819e0241dfdb821bac7f} 7:08:02 PM
• flag accepted EF{3bbe5a002805e57f698ec8361e4fc2fc} 7:08:06 PM
• flag accepted EF{1fce66167805afb32520eb18bde5305f} 7:08:11 PM
• flag accepted EF{1fce66167805afb32520eb18bde5305f} 7:08:17 PM
• finding CWE-306 at app.py:15 7:08:27 PM
• finding CWE-306 at app.py:14 7:08:28 PM
• flag accepted EF{1fce66167805afb32520eb18bde5305f} 7:08:51 PM
• flag accepted EF{0d3c1c487424f653f510ca634e59c85b} 7:08:57 PM
• flag accepted EF{fd837efb99b1819e0241dfdb821bac7f} 7:09:03 PM

Tool activity

[effractor-efbench] checking API Server at https://api.mvp.effractor.com
[effractor-efbench] operation a9100bf7-43a7-4bd8-af28-9c4dbd7edc75 started with 5 agent(s)
[effractor-efbench] agent reported accepted flag EF{1fce66167805afb32520eb18bde5305f}
[effractor-efbench] WARNING: agents did not finish cleanup: efbench-1
[effractor-efbench] finished: flag_accepted

Vulnerabilities the ground truth, and how the tool did

• captured g1 Flag disclosure at /gadget/g1 CWE-200 easy capturable app.py
• captured g2 Flag disclosure at /gadget/g2 CWE-200 easy capturable app.py

Captured means the tool exploited the vulnerability and submitted its flag. Found means it located the flaw by class and position without proving exploitation.

Findings what the tool reported

• CWE-306 app.py:15 The application exposes multiple sensitive endpoints (/gadget/g1, /gadget/g2, /stage/1, /stage/2) that return flags from environment variables without requiring any authentication or authorization. Lines 15-27 in app.py directly return flag values from os.environ without validating user identity or permissions, allowing unauthorized access to sensitive data.
• CWE-306 app.py:14 The do_GET method in app.py exposes sensitive flags through HTTP endpoints (/gadget/g1, /gadget/g2, /stage/1, /stage/2) without any authentication or authorization checks. Any user can directly access these endpoints to retrieve flag values from environment variables.

Findings are matched to injected vulnerabilities by class and location. Unmatched findings count against precision.