Another common cause of false positives is user-defined sanitizers, such as those using regular expressions to validate or filter input. Let's take validation as an example, since it also requires additional consideration of control flow: To properly handle this example, you need to: (1) be able to analyze the impact of the regular expression /^[a-zA-Z0-9_]+$/ on different vulnerabilities; (2) consider the impact of preg_match($pattern, $username) within the if branch. This is called control flow sensitivity.


We offer professional hacking services, including penetration testing, website privilege escalation, password cracking, and data breach investigations. Inquiries are welcome. @PipiShrimp

In other words, when the agent performs a certain anti-virus evasion operation, xss_manipulator receives the agent's command to perform anti-virus evasion operations on the XSS payload.

Here, we need to discuss the getattr function, which can retrieve attributes or methods from an object based on their string names. If the attribute is a callable method, it can be called directly.


We offer professional hacking services, including penetration testing, website privilege escalation, password cracking, and data breach investigations. Inquiries are welcome. @PipiShrimp

Brute-force website login To log in to a website server, you need to know the username, password, or both. You can use Hydra to break into a POST form and find the username and password fields and their id/name attributes in the HTTP source.

The command syntax is as follows (assuming the id/name attributes of the username and password fields are userField and passwordField, respectively).


We offer professional hacking services, including penetration testing, website privilege escalation, password cracking, and data breach investigations. Inquiries are welcome. @PipiShrimp

Once logged in, you can upload a WAR file to obtain a webshell and control the machine. Of course, you can also collect a lot of useful information from the host you've gained access to. Ideally, you should also obtain some credentials for later reuse.

We offer professional hacking services, including penetration testing, website privilege escalation, password cracking, and data breach investigations. Inquiries are welcome. @PipiShrimp

It looked like it had a lot of features, so I thought getting a shell was a sure thing. But after a bunch of things, including whitelisting both upload points and messing around with various things, I still couldn't get a shell. I was so desperate that I even posted on a forum asking for the source code...

We offer professional hacking services, including penetration testing, website privilege escalation, password cracking, and data breach investigations. Inquiries are welcome. @PipiShrimp

sqlmap is a powerful open-source SQL injection automation tool used to detect and exploit SQL injection vulnerabilities. It is developed in Python, therefore a Python environment is required to run it.

Test environment: Ubuntu 16.04


We offer professional hacking services, including penetration testing, website privilege escalation, password cracking, and data breach investigations. Inquiries are welcome. @PipiShrimp

-p Web port setting (default port 80)

-m Multi-threaded execution

-t Timeout

-r Set the starting directory for scanning

-ssl Whether to use SSL for online connection


We offer professional hacking services, including penetration testing, website privilege escalation, password cracking, and data breach investigations. Inquiries are welcome. @PipiShrimp