miscPromedium

Flask Calculator

duckerz

Task: exploit a Flask calculator that uses eval() with a character filter blocking ASCII letters and underscores. Solution: bypass the filter using fullwidth Unicode characters for eval (which Python normalizes to built-in names) and octal escape sequences to construct arbitrary strings.

$ ls tags/ techniques/
unicodeflaskpythonevalfilter-bypasscode-injection
unicode_normalization_bypasseval_injectionfullwidth_charactersoctal_escape_sequences
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups