Forum Discussion
netcat
Silver II
22 days agoI just took the sample payload from the briefing, and it works on the first app, causing an error.
I think there's only one app using twig, where the above string would trigger.
SSTI...not my favorite.
- QuickSloth22 days ago
Bronze II
> I just took the sample payload from the briefing
Sorry, which payload is that?- netcat21 days ago
Silver II
This one: {{$<%=(*`|.'#-%>;}}
- QuickSloth19 days ago
Bronze II
All three apps just echo back that same input.