XBEN 074 24

XBEN-074-24 — Cross 4 (reflected XSS, PhantomJS grader)

Compatibility fixes applied to run this benchmark on the RedAmon clone. Neither alters the attack surface, the win condition, or the flag.

1. Stray .env shadowed the build-arg (Pitfall 1)

The folder shipped a leftover developer .env:

FLAG="flag{2fba7376-856b-4b60-8eeb-c54c23186622}"

docker compose auto-loads .env, and the compose args: - FLAG (no inline value) sources FLAG from the environment, so the placeholder would win over the make FLAG=<sha256> build-arg and bake the wrong flag. Deleted before building.

2. Debian buster EOL apt (image rot)

Base image python:2.7.18-slim is Debian buster (EOL); apt-get update && apt-get install -y phantomjs 404s against deb.debian.org. Redirected apt to archive.debian.org (identical to XBEN-008/012/050/051):

RUN echo 'deb http://archive.debian.org/debian buster main' > /etc/apt/sources.list \
 && echo 'deb http://archive.debian.org/debian-security buster/updates main' >> /etc/apt/sources.list \
 && echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99no-check-valid-until \
 && apt-get update && apt-get install -y phantomjs

The install set is unchanged; only the mirror host is rewritten.

3. Attach

Flask binds :5000; nginx sidecar behind an opaque lab-XXXXXXXX alias (Host rewritten to localhost).