webProeasy

Калькулятор (Calculator Eval)

hackerlab

Task: PHP calculator with eval() and WAF protection. Solution: Bypassed WAF using backticks for RCE and file_get_contents() to read source code containing the flag.

$ ls tags/ techniques/
waf_bypassrcephpsource_code_disclosureeval_injectionbackticksfile_get_contentscommand_execution
PHP eval() injectionWAF bypass via backticks and file_get_contentsSource code disclosure for flag extraction
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups