ef ef-bench
Back to run

Smoke Test Challenge

easy passed
Recall
100%
Precision
50%
Gadgets found
2 / 2
Findings
1 / 2
Kill chain
2 / 2 (reached stage 2)

Live submissions what the tool sent during the run

  • flag accepted EF{1fce66167805afb32520eb18bde5305f} 8:44:42 PM
  • flag accepted EF{3bbe5a002805e57f698ec8361e4fc2fc} 8:44:47 PM
  • flag accepted EF{0d3c1c487424f653f510ca634e59c85b} 8:44:50 PM
  • flag accepted EF{0d3c1c487424f653f510ca634e59c85b} 8:44:51 PM
  • flag accepted EF{fd837efb99b1819e0241dfdb821bac7f} 8:44:56 PM
  • flag accepted EF{fd837efb99b1819e0241dfdb821bac7f} 8:44:56 PM
  • flag accepted EF{3bbe5a002805e57f698ec8361e4fc2fc} 8:45:00 PM
  • flag accepted EF{1fce66167805afb32520eb18bde5305f} 8:45:06 PM
  • finding CWE-306 at app.py:19 8:45:08 PM
  • flag accepted EF{1fce66167805afb32520eb18bde5305f} 8:45:22 PM
  • finding 200 at app.py:16 8:45:37 PM

Tool activity

stdout

[effractor-efbench] checking API Server at https://api.mvp.effractor.com
[effractor-efbench] operation a1994aa2-a9d1-4897-9ea7-3a4ffb9ba1fe started with 5 agent(s)
[effractor-efbench] agent reported accepted flag EF{1fce66167805afb32520eb18bde5305f}
[effractor-efbench] finished: flag_accepted

Vulnerabilities the ground truth, and how the tool did

  • captured g1 Flag disclosure at /gadget/g1 CWE-200 easy capturable app.py
  • captured g2 Flag disclosure at /gadget/g2 CWE-200 easy capturable app.py

Captured means the tool exploited the vulnerability and submitted its flag. Found means it located the flaw by class and position without proving exploitation.

Findings what the tool reported

  • CWE-306 app.py:19 The do_GET method exposes sensitive flags from environment variables through unauthenticated HTTP endpoints (/gadget/g1, /gadget/g2, /stage/1, /stage/2). No authentication or authorization is implemented, allowing any user to retrieve flags by simply accessing these endpoints. The /stage/2 endpoint has a token check, but the required token is itself exposed through the unauthenticated /stage/1 endpoint.
  • 200 app.py:16 Gadget endpoints expose sensitive environment variables without authentication

Findings are matched to injected vulnerabilities by class and location. Unmatched findings count against precision.