3 ms·
> Within the tests/evalExploit directory, there is a php file that runs eval() on user input, a common code-injection vulnerability, to experience the power of
by duckerude 8y ago
> Within the tests/evalExploit directory, there is a php file that runs eval() on user input, a common code-injection vulnerability, to experience the power of Polyscripting.
What happens if you eval "`rm -rf /*`;" or "`grep root /etc/passwd`;"? Does it scramble backticks?
- maxk42 8y agoIt claims to modify the AST, so yes, hypothetically, it would scramble backticks. Note that I have not reviewed the code -- I'm only going by the claims in the article.
- notveryrational 8y agoI doubt it scrambles backticks. In its example on the webpage it just creates a keywork scrambler. The grammar is intact with most of the lexing.