Avatar

Labs / Flask Error

  • Challenge
  • Released 17 Jul 2025

Flask Error

Start the machine, hack the system, and find the hidden flags to complete this challenge and earn points!

1
Flags
1
Points
Challenge
Solution Available
Pro Exclusive
Start Lab Environment
~1-2 min setup
AWS dedicated
Private instance
Industry standard
Challenge

Flask Calculator Debug Mode - Complete Solution Walkthrough

Step 1: Access the Calculator

  1. Visit the root URL of the Flask app. You will see a calculator interface.
  2. The page shows a form where you can enter mathematical expressions.
  3. Try some basic calculations first: 2 + 3, 10 - 4, 6 * 2, 15 / 3

Step 2: Trigger Division by Zero Error

  1. In the expression input field, enter a division by zero expression like: 5 / 0, 10 / 0, or 1 / 0
  2. Click the "Calculate" button.
  3. This will trigger a ZeroDivisionError and display the Flask debug page with the traceback.

Step 3: Extract Flag from Debug Traceback

  1. On the debug page, look for the traceback section that shows the error location.
  2. Find the line that shows: File "/app/app.py", line X, in calculate
  3. Look at the source code displayed in the traceback, specifically around the error line.
  4. You will see a comment in the source code: # flag = '25402d11-e607-499c-af03-3f1a59edcef5'
  5. The flag is: 25402d11-e607-499c-af03-3f1a59edcef5

Alternative Method: Interactive Console

  1. If the interactive console is available on the debug page, you can also access it.
  2. Type flag in the console and press Enter.
  3. The console will output: '25402d11-e607-499c-af03-3f1a59edcef5'

Security Implications

  • Debug Mode Exposure: Never run Flask (or any web app) in debug mode in production environments.
  • Source Code Disclosure: Debug tracebacks can reveal source code including comments that may contain sensitive information.
  • Error Handling: Division by zero errors should be handled gracefully without exposing debug information.
  • Information Disclosure: Debug pages can reveal sensitive information like secret keys, flags, and application structure.
  • Real-world Impact: This vulnerability is commonly found in development servers accidentally exposed to the internet.
  • Best Practices: Always disable debug mode, implement proper error handling, and use production-ready configurations.