# Snyk Fetch the Flag CTF 2023 writeup: Audiopolis

DevFeed: [Snyk Fetch the Flag CTF 2023 writeup: Audiopolis](<https://devfeed.tech/articles/snyk-fetch-the-flag-ctf-2023-writeup-audiopolis-8127.md>)

Original publisher: [Read original article](<https://snyk.io/blog/snyk-fetch-the-flag-ctf-2023-writeup-audiopolis/>)

Author: John Hammond

Published: 2023-11-30T05:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [ctf](<https://devfeed.tech/topics/ctf.md>), [asr](<https://devfeed.tech/topics/asr.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>), [App](<https://devfeed.tech/topics/app.md>)

Tags: [app](<https://devfeed.tech/tags/app.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [ctf](<https://devfeed.tech/tags/ctf.md>), [developer](<https://devfeed.tech/tags/developer.md>), [external](<https://devfeed.tech/tags/external.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk](<https://devfeed.tech/tags/snyk.md>), [speech](<https://devfeed.tech/tags/speech.md>), [web](<https://devfeed.tech/tags/web.md>), [web-app](<https://devfeed.tech/tags/web-app.md>)

## AI overview

This Snyk Fetch the Flag CTF 2023 write-up explains the Audiopolis challenge. The challenge uses a web app that accepts a .wav file and returns a speech-to-text transcript. The article shows how echoing generated transcript text creates a command-injection vulnerability and how a sleep test confirms command execution before locating the flag.

## Source excerpt

If you were at Snyk's 2023 Fetch the Flag and are looking for the answer to the Audiopolis challenge, you've come to the right place. Let's walk through the solution together!