// HackTricks · Network Services

Python

Python

Python-specific execution probe

When an input appears to be evaluated as a Python expression, a harmless call to str() can help confirm that the result is being executed rather than reflected verbatim. Adapt the surrounding quotes to the injection context:[1]

"+str(True)+"  # If True is printed, the expression was evaluated.

Do not treat this probe alone as proof that arbitrary statements or operating-system commands can run; the sink may expose only a restricted expression language.

Readme

Readme

Readme

References

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.