Vulnerability field guide
Remote Code Execution
Remote code execution is the worst outcome a web bug can produce. Here is how attacker-controlled input reaches an execution sink, the common vectors that get there, and how to close them.
2 articles11 min totalOverview to advanced techniques
Start here
__import__('os').popen('id')Step 01 · Start with the overview
Remote Code Execution6 min read
Remote Code Execution: When User Input Becomes Server Code
Remote code execution is the worst outcome a web bug can produce. Here is how attacker-controlled input reaches an execution sink, the common vectors that get there, and how to close them.
Read the overviewContinue the field guide
1 focused deep-dives