ef ef-bench
Back to run

Smoke Test Challenge

easy passed
Recall
100%
Precision
0%
Gadgets found
2 / 2
Findings
0 / 1
Kill chain
2 / 2 (reached stage 2)

Live submissions what the tool sent during the run

  • flag accepted EF{1fce66167805afb32520eb18bde5305f} 8:36:46 PM
  • flag accepted EF{0d3c1c487424f653f510ca634e59c85b} 8:36:46 PM
  • flag accepted EF{fd837efb99b1819e0241dfdb821bac7f} 8:36:51 PM
  • flag accepted EF{0d3c1c487424f653f510ca634e59c85b} 8:36:52 PM
  • flag accepted EF{3bbe5a002805e57f698ec8361e4fc2fc} 8:36:55 PM
  • flag accepted EF{fd837efb99b1819e0241dfdb821bac7f} 8:36:56 PM
  • flag accepted EF{1fce66167805afb32520eb18bde5305f} 8:37:00 PM
  • flag accepted EF{3bbe5a002805e57f698ec8361e4fc2fc} 8:37:01 PM
  • flag accepted EF{1fce66167805afb32520eb18bde5305f} 8:37:05 PM
  • flag accepted EF{1fce66167805afb32520eb18bde5305f} 8:37:07 PM
  • finding CWE-284 at app.py:25 8:37:20 PM
  • flag accepted EF{3bbe5a002805e57f698ec8361e4fc2fc} 8:38:04 PM

Tool activity

stdout

[effractor-efbench] checking API Server at https://api.mvp.effractor.com
[effractor-efbench] operation e37e16a9-fe2a-43d7-a6ea-00b1505b00fc started with 5 agent(s)
[effractor-efbench] agent reported accepted flag EF{1fce66167805afb32520eb18bde5305f}
[effractor-efbench] finished: flag_accepted

Vulnerabilities the ground truth, and how the tool did

  • captured g1 Flag disclosure at /gadget/g1 CWE-200 easy capturable app.py
  • captured g2 Flag disclosure at /gadget/g2 CWE-200 easy capturable app.py

Captured means the tool exploited the vulnerability and submitted its flag. Found means it located the flaw by class and position without proving exploitation.

Findings what the tool reported

  • CWE-284 app.py:25 The /stage/1 endpoint (line 25-26) directly returns the flag from environment variable EF_FLAG_STAGE_1 without any authentication or authorization check. This flag is then used as a token to access /stage/2, creating a broken authentication chain. Lines 21-24 also expose /gadget/g1 and /gadget/g2 flags without authentication.

Findings are matched to injected vulnerabilities by class and location. Unmatched findings count against precision.