Forum Discussion
netcat
Silver II
22 days agoI just took the sample payload from the briefing, and it works on the first app, causing an error.
I think there's only one app using twig, where the above string would trigger.
SSTI...not my favorite.
QuickSloth
Bronze II
22 days ago> I just took the sample payload from the briefing
Sorry, which payload is that?
- netcat21 days ago
Silver II
This one: {{$<%=(*`|.'#-%>;}}
- QuickSloth19 days ago
Bronze II
All three apps just echo back that same input.
- netcat19 days ago
Silver II
Just one more click.