1

There was this challenge in one of the CTF's I played in which you had to exploit the input vulnerability of Python 2.x . I was just wondering that since the input function in Python 2.x is same as eval(raw_input()) you could basically give a power off or move into another directory. How do you setup the server such that you can prevent people from doing that but also let them allow you to exploit the vulnerability?

Improve this question

1 Answer 1

Reset to default
1

One simple way I can think of is to sanitize user input using a blacklist which contains the commands you do not want to allow, such as the ones you have mentioned. OWASP provides very good explanation about White/Black lists HERE

Improve this answer
2
  • Wouldnt whitelist be better?
    – yeah_well
    Commented Aug 11, 2019 at 20:08
  • The simple answer is - it depends. Both should work but it will boil down to what is easier to implement in that specific scenario
    – Hummus_Ful
    Commented Aug 11, 2019 at 20:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .