Web Hacking → Injection
Someone wraps eval() in a blacklist, strips __builtins__, and calls it a sandbox. Then a CTF player types a thirty-character objec…
When user input lands in the template source instead of the context dict, the rendering engine treats it as code. The universal me…
How one user-controlled string passed to include() turns into file disclosure, log poisoning and full RCE. Every angle: path trave…
How a serialized blob from a cookie, queue, cache or model file turns into remote code execution. Every language's landmines: PHP …
How a single <!DOCTYPE> line turns an XML parser into a file-read, SSRF and DoS primitive. Every variant: classic file read,…