Web Hacking → Injection
Someone wraps eval() in a blacklist, strips __builtins__, and calls it a sandbox. Then a CTF player types a thirty-character objec…
Somewhere on the app there is a harmless little tool — ping a host, look up a domain, export a PDF. Behind it, a developer glued y…
When user input lands in the template source instead of the context dict, the rendering engine treats it as code. The universal me…
How one user-controlled string passed to include() turns into file disclosure, log poisoning and full RCE. Every angle: path trave…
How a serialized blob from a cookie, queue, cache or model file turns into remote code execution. Every language's landmines: PHP …
How a single <!DOCTYPE> line turns an XML parser into a file-read, SSRF and DoS primitive. Every variant: classic file read,…
Deep technical analysis of insecure deserialization across Java, PHP, Python, and Node.js — ysoserial chains, pickle RCE, phpggc P…
The string-concatenation bug that has emptied more credential tables than any other. The mechanism byte by byte — how attacker inp…