miscmedium
Flask Calculator
duckerz
Task: exploit a Flask calculator that uses eval() with a character filter blocking ASCII letters and underscores. Solution: bypass the filter using fullwidth Unicode characters for eval (which Python normalizes to built-in names) and octal escape sequences to construct arbitrary strings.
$ ls tags/ techniques/
unicode_normalization_bypasseval_injectionfullwidth_charactersoctal_escape_sequences
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub, then upgrade to Pro.
$ssh [email protected]