Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

Posts tagged #rce

9 posts

All topics Clear tag filter

InjectionOverview ; id

Command Injection7 min read

Command Injection: How One Semicolon Hands Over Your Server

OS command injection turns a harmless-looking parameter into a shell prompt for an attacker. Here is how shell metacharacters escape into system commands, the blind variants, and the fix that ends it.

Injection 6*7===42

Remote Code Execution5 min read

Eval Injection: When a Runtime Treats User Text as Code

Dynamic evaluators such as eval, new Function and exec turn text into program logic. Learn how the boundary fails, how harmless arithmetic proves it, and how a narrow data model replaces evaluation.

Files, objects & APIsOverview (os.system, ("id",))

Insecure Deserialization3 min read

Insecure Deserialization: How a Serialized Blob Becomes Remote Code Execution

When an application rebuilds objects from untrusted serialized data, attacker-crafted gadget chains can run code during deserialization itself. Here is how object injection leads to RCE, and why data-only formats are the fix.

Files, objects & APIs O:4:"User":1:{s:4:"name";...}

Insecure Deserialization5 min read

PHP Object Injection: unserialize() and the Magic-Method Chain

Calling unserialize() on attacker-controlled input instantiates arbitrary classes and fires their magic methods automatically. Here is how a POP gadget chain rides __wakeup and __destruct to a dangerous sink, and why json_decode is the fix.

Files, objects & APIs !!python/object/apply:os.system

Insecure Deserialization4 min read

Python Deserialization: pickle, PyYAML and the reduce Trap

pickle.loads on untrusted bytes runs code because __reduce__ returns a callable that executes at load time, and yaml.load without SafeLoader builds arbitrary objects. Here is the minimal exploit, and why safe_load and JSON are the fix.

InjectionOverview __import__('os').popen('id')

Remote Code Execution6 min read

Remote Code Execution: When User Input Becomes Server Code

Remote code execution is the worst outcome a web bug can produce. Here is how attacker-controlled input reaches an execution sink, the common vectors that get there, and how to close them.

InjectionOverview {{7*7}}

Server-Side Template Injection6 min read

Server-Side Template Injection: From {{7*7}} to Remote Code Execution

When user input is stitched into a server-side template, the template engine becomes an interpreter for the attacker. Here is how a harmless-looking arithmetic probe escalates to full server compromise, and how to design the bug out entirely.

Files, objects & APIs {"$type":"ObjectDataProvider"}

Insecure Deserialization4 min read

.NET Deserialization: BinaryFormatter, Json.NET and TypeNameHandling

On .NET, the type information lives inside the payload. BinaryFormatter and a Json.NET $type directive will happily instantiate whatever class an attacker names — including gadgets that reach a process start. Here is how it leads to RCE, and the binder allowlist that stops it.

Files, objects & APIs rO0ABXNyABZqYXZhLnV0aWw

Insecure Deserialization4 min read

Java Deserialization: ObjectInputStream and the Gadget-Chain Problem

Calling ObjectInputStream.readObject() on bytes an attacker controls is enough to reach Runtime.exec during deserialization itself. Here is why a gadget chain runs even though your code never expected that type, and how look-ahead filtering shuts it down.

Understand the bug. See the exploit. Ship the fix.

Posts tagged #rce

Command Injection: How One Semicolon Hands Over Your Server

Eval Injection: When a Runtime Treats User Text as Code

Insecure Deserialization: How a Serialized Blob Becomes Remote Code Execution

PHP Object Injection: unserialize() and the Magic-Method Chain

Python Deserialization: pickle, PyYAML and the __reduce__ Trap

Remote Code Execution: When User Input Becomes Server Code

Server-Side Template Injection: From {{7*7}} to Remote Code Execution

.NET Deserialization: BinaryFormatter, Json.NET and TypeNameHandling

Java Deserialization: ObjectInputStream and the Gadget-Chain Problem

Python Deserialization: pickle, PyYAML and the reduce Trap