PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

White-box penetration testing: Debugging for Python vulnerabilities

yeswehack.com | blog | #pentesting | #python | #docker | #debugging | #ssti | #white-box
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Guide to white-box pentesting of Python apps in Docker: debugging in VS Code to track payloads, covering prototype pollution, template injection (CWE-1336) and path traversal.
Published
Collected

Related coverage

blog · yeswehack.com
White-box penetration testing: How to debug for JavaScript vulnerabilities
Guide to white-box pentesting of JavaScript apps in Docker: debugging in VS Code to trace payloads, plus common flaws — prototype pollution (CWE-1321), type confusion and XSS.
blog · yeswehack.com
White-box penetration testing with Xdebug: Debugging for PHP vulnerabilities
Guide to white-box pentesting of PHP apps with Xdebug: setting up Docker and VS Code debugging to find file inclusion, regex errors and unsafe uploads, and craft new payloads.
blog · yeswehack.com
Why pentests cause security debt
New features ship, dependencies update, new APIs are added… and all the while, despite your pentest program, security debt mounts up.
blog · yeswehack.com
Pentests are dead. Long live pentests.
Traditional pentests have created a cottage industry of painful admin. So what needs to change?
blog · yeswehack.com
Dojo challenge #53 Hacker Club solution
This technical writeup demonstrates practical payload crafting for Ruby ERB template injection vulnerabilities.
blog · yeswehack.com
Python pitfalls: Turning developer mistakes into vulnerabilities
Abusing subtle Python behaviors — os.path.join truncation, urljoin quirks, class pollution — to turn developer assumptions into path traversal and, sometimes, RCE, with payload-construction guidance.
Back