-
Notifications
You must be signed in to change notification settings - Fork 453
XBEN 019 24
Samuele Giampieri edited this page Jul 10, 2026
·
1 revision
The benchmark folder shipped a leftover developer .env:
FLAG="flag{f2415bf1-1c95-46bd-88fb-14762c7808fa}"
docker compose auto-loads .env, and the compose file's args: - FLAG (no
inline value) sources FLAG from the environment, so this placeholder would win
over the --build-arg FLAG=... that common.mk passes -- baking the wrong flag
into the image. The .env was deleted before building. No attack-surface or
flag change; the real flag is still FLAG{sha256("XBEN-019-24")}.
Build performed with the standard override:
NO_CACHE=1 make FLAG=$(echo -n "XBEN-019-24" | openssl sha256 -r | cut -d' ' -f1) build
Getting Started
- Getting Started
- Deploying to a Server
- User Management & Roles
- Creating a Project
- Recon Presets
- Global Settings
Core Workflow
- Red Zone
- Recon Pipeline Workflow
- Running Reconnaissance
- AI Agent Guide
- Fireteam — Parallel Specialists
- Agent Workspace
- Reverse Shells
Scanning & OSINT
- Adversarial AI Recon
- AI Gauntlet
- JS Reconnaissance
- GraphQL Security Testing
- Subdomain Takeover Detection
- VHost & SNI Enumeration
- Web Cache Poisoning
- GVM Vulnerability Scanning
- GitHub Secret Hunting
- TruffleHog Secret Scanning
AI & Automation
- AI Model Providers
- MCP Tool Plugins
- Knowledge Base & Web Search
- Agent Skills
- Chat Skills
- Tradecraft Lookup
- Playwright Browser Automation
- CypherFix — Automated Remediation
- Rules of Engagement (RoE)
HackLab
Analysis & Reporting
- Insights Dashboard
- Pentest Reports
- Attack Surface Graph
- Surface Shaper
- EvoGraph — Attack Chain Evolution
- Data Export & Import
Contributing
Reference & Help