From 261d8895c100b777b9b17940ee82711d10a2ac0b Mon Sep 17 00:00:00 2001 From: TrebledJ <39648915+TrebledJ@users.noreply.github.com> Date: Wed, 14 Aug 2024 01:47:25 +0800 Subject: [PATCH] upload slides + demo --- .../2024-08-14-from-input-to-injection.html | 23 ++-- .../2024-08-14-from-input-to-injection.pdf | Bin 1213596 -> 1214077 bytes .../demo-from-input-to-injection/format.py | 14 +++ .../demo-from-input-to-injection/server.py | 113 ++++++++++++++++++ 4 files changed, 142 insertions(+), 8 deletions(-) create mode 100644 scripts/demo-from-input-to-injection/format.py create mode 100644 scripts/demo-from-input-to-injection/server.py diff --git a/content/pages/slides/from-input-to-injection/2024-08-14-from-input-to-injection.html b/content/pages/slides/from-input-to-injection/2024-08-14-from-input-to-injection.html index dcaf866f7..e8fee1c67 100644 --- a/content/pages/slides/from-input-to-injection/2024-08-14-from-input-to-injection.html +++ b/content/pages/slides/from-input-to-injection/2024-08-14-from-input-to-injection.html @@ -43,7 +43,7 @@ highlight.js http://highlightjs.readthedocs.io/en/latest/style-guide.html http://highlightjs.readthedocs.io/en/latest/css-classes-reference.html -*/div#\:\$p>svg>foreignObject>section .hljs{display:block;overflow-x:auto;padding:0.5em;background:#2E3440}div#\:\$p>svg>foreignObject>section .hljs,div#\:\$p>svg>foreignObject>section .hljs-subst{color:#D8DEE9}div#\:\$p>svg>foreignObject>section .hljs-selector-tag{color:#81A1C1}div#\:\$p>svg>foreignObject>section .hljs-selector-id{color:#8FBCBB;font-weight:bold}div#\:\$p>svg>foreignObject>section .hljs-selector-class{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-selector-attr{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-selector-pseudo{color:#88C0D0}div#\:\$p>svg>foreignObject>section .hljs-addition{background-color:rgba(163,190,140,0.5)}div#\:\$p>svg>foreignObject>section .hljs-deletion{background-color:rgba(191,97,106,0.5)}div#\:\$p>svg>foreignObject>section .hljs-built_in,div#\:\$p>svg>foreignObject>section .hljs-type{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-class{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-function{color:#88C0D0}div#\:\$p>svg>foreignObject>section .hljs-function>.hljs-title{color:#88C0D0}div#\:\$p>svg>foreignObject>section .hljs-keyword,div#\:\$p>svg>foreignObject>section .hljs-literal,div#\:\$p>svg>foreignObject>section .hljs-symbol{color:#81A1C1}div#\:\$p>svg>foreignObject>section .hljs-number{color:#B48EAD}div#\:\$p>svg>foreignObject>section .hljs-regexp{color:#EBCB8B}div#\:\$p>svg>foreignObject>section .hljs-string{color:#A3BE8C}div#\:\$p>svg>foreignObject>section .hljs-title{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-params{color:#D8DEE9}div#\:\$p>svg>foreignObject>section .hljs-bullet{color:#81A1C1}div#\:\$p>svg>foreignObject>section .hljs-code{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-emphasis{font-style:italic}div#\:\$p>svg>foreignObject>section .hljs-formula{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-strong{font-weight:bold}div#\:\$p>svg>foreignObject>section .hljs-link:hover{text-decoration:underline}div#\:\$p>svg>foreignObject>section .hljs-quote{color:#4C566A}div#\:\$p>svg>foreignObject>section .hljs-comment{color:#4C566A}div#\:\$p>svg>foreignObject>section .hljs-doctag{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-meta,div#\:\$p>svg>foreignObject>section .hljs-meta-keyword{color:#5E81AC}div#\:\$p>svg>foreignObject>section .hljs-meta-string{color:#A3BE8C}div#\:\$p>svg>foreignObject>section .hljs-attr{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-attribute{color:#D8DEE9}div#\:\$p>svg>foreignObject>section .hljs-builtin-name{color:#81A1C1}div#\:\$p>svg>foreignObject>section .hljs-name{color:#81A1C1}div#\:\$p>svg>foreignObject>section .hljs-section{color:#88C0D0}div#\:\$p>svg>foreignObject>section .hljs-tag{color:#81A1C1}div#\:\$p>svg>foreignObject>section .hljs-variable{color:#D8DEE9}div#\:\$p>svg>foreignObject>section .hljs-template-variable{color:#D8DEE9}div#\:\$p>svg>foreignObject>section .hljs-template-tag{color:#5E81AC}div#\:\$p>svg>foreignObject>section .abnf .hljs-attribute{color:#88C0D0}div#\:\$p>svg>foreignObject>section .abnf .hljs-symbol{color:#EBCB8B}div#\:\$p>svg>foreignObject>section .apache .hljs-attribute{color:#88C0D0}div#\:\$p>svg>foreignObject>section .apache .hljs-section{color:#81A1C1}div#\:\$p>svg>foreignObject>section .arduino .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .aspectj .hljs-meta{color:#D08770}div#\:\$p>svg>foreignObject>section .aspectj>.hljs-title{color:#88C0D0}div#\:\$p>svg>foreignObject>section .bnf .hljs-attribute{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .clojure .hljs-name{color:#88C0D0}div#\:\$p>svg>foreignObject>section .clojure .hljs-symbol{color:#EBCB8B}div#\:\$p>svg>foreignObject>section .coq .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .cpp .hljs-meta-string{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .css .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .css .hljs-keyword{color:#D08770}div#\:\$p>svg>foreignObject>section .diff .hljs-meta{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .ebnf .hljs-attribute{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .glsl .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .groovy .hljs-meta:not(:first-child){color:#D08770}div#\:\$p>svg>foreignObject>section .haxe .hljs-meta{color:#D08770}div#\:\$p>svg>foreignObject>section .java .hljs-meta{color:#D08770}div#\:\$p>svg>foreignObject>section .ldif .hljs-attribute{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .lisp .hljs-name{color:#88C0D0}div#\:\$p>svg>foreignObject>section .lua .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .moonscript .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .nginx .hljs-attribute{color:#88C0D0}div#\:\$p>svg>foreignObject>section .nginx .hljs-section{color:#5E81AC}div#\:\$p>svg>foreignObject>section .pf .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .processing .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .scss .hljs-keyword{color:#81A1C1}div#\:\$p>svg>foreignObject>section .stylus .hljs-keyword{color:#81A1C1}div#\:\$p>svg>foreignObject>section .swift .hljs-meta{color:#D08770}div#\:\$p>svg>foreignObject>section .vim .hljs-built_in{color:#88C0D0;font-style:italic}div#\:\$p>svg>foreignObject>section .yaml .hljs-meta{color:#D08770}div#\:\$p>svg>foreignObject>section svg[data-marp-fitting=svg]{max-height:563px}div#\:\$p>svg>foreignObject>section :is(h1,marp-h1){border-bottom:none;color:#ECEFF4;font-size:1.6em}div#\:\$p>svg>foreignObject>section :is(h2,marp-h2){border-bottom:none;font-size:1.3em}div#\:\$p>svg>foreignObject>section :is(h3,marp-h3){font-size:1.1em}div#\:\$p>svg>foreignObject>section :is(h4,marp-h4){font-size:1.05em}div#\:\$p>svg>foreignObject>section :is(h5,marp-h5){font-size:1em}div#\:\$p>svg>foreignObject>section :is(h6,marp-h6){font-size:0.9em}div#\:\$p>svg>foreignObject>section :is(h1,marp-h1) strong,div#\:\$p>svg>foreignObject>section :is(h2,marp-h2) strong,div#\:\$p>svg>foreignObject>section :is(h3,marp-h3) strong,div#\:\$p>svg>foreignObject>section :is(h4,marp-h4) strong,div#\:\$p>svg>foreignObject>section :is(h5,marp-h5) strong,div#\:\$p>svg>foreignObject>section :is(h6,marp-h6) strong{font-weight:inherit;color:#48c}div#\:\$p>svg>foreignObject>section a{color:#88C0D0}div#\:\$p>svg>foreignObject>section hr{height:0;padding-top:0.25em}div#\:\$p>svg>foreignObject>section :is(pre,marp-pre){border:1px solid #8FBCBB;line-height:1.15;overflow:visible;background-color:#2E3440}div#\:\$p>svg>foreignObject>section :is(pre,marp-pre) code svg[data-marp-fitting=svg]{max-height:529px}div#\:\$p>svg>foreignObject>section code{background-color:#2E3440;color:#88C0D0}div#\:\$p>svg>foreignObject>section footer,div#\:\$p>svg>foreignObject>section header{margin:0;position:absolute;left:30px;color:rgba(102,102,102,0.75);font-size:18px}div#\:\$p>svg>foreignObject>section header{top:21px}div#\:\$p>svg>foreignObject>section footer{bottom:21px}div#\:\$p>svg>foreignObject>section{background:#3B4252;color:#E5E9F0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;align-items:stretch;display:flex;flex-direction:column;flex-wrap:nowrap;font-size:29px;height:720px;justify-content:center;padding:78.5px;width:1280px}div#\:\$p>svg>foreignObject>section{--marpit-root-font-size:29px}div#\:\$p>svg>foreignObject>section.lead :is(h1,marp-h1){font-size:3.1em}div#\:\$p>svg>foreignObject>section>:last-child,div#\:\$p>svg>foreignObject>section[data-footer]>:nth-last-child(2){margin-bottom:0}div#\:\$p>svg>foreignObject>section>:first-child,div#\:\$p>svg>foreignObject>section>header:first-child+*{margin-top:0}div#\:\$p>svg>foreignObject>section:after{position:absolute;padding:0;right:30px;bottom:21px;font-size:24px;color:#777}div#\:\$p>svg>foreignObject>section:after{--marpit-root-font-size:24px}div#\:\$p>svg>foreignObject>section[data-color] :is(h1,marp-h1),div#\:\$p>svg>foreignObject>section[data-color] :is(h2,marp-h2),div#\:\$p>svg>foreignObject>section[data-color] :is(h3,marp-h3),div#\:\$p>svg>foreignObject>section[data-color] :is(h4,marp-h4),div#\:\$p>svg>foreignObject>section[data-color] :is(h5,marp-h5),div#\:\$p>svg>foreignObject>section[data-color] :is(h6,marp-h6){color:currentColor}div#\:\$p>svg>foreignObject>section *{font-size:32px}div#\:\$p>svg>foreignObject>section section{--marpit-root-font-size:32px}div#\:\$p>svg>foreignObject>section .hljs-comment{color:#96a0ab}div#\:\$p>svg>foreignObject>section footer{color:#888}div#\:\$p>svg>foreignObject>section :is(h1,marp-h1){font-size:80px}div#\:\$p>svg>foreignObject>section :is(h2,marp-h2){font-size:60px}div#\:\$p>svg>foreignObject>section :is(h3,marp-h3){font-size:48px}div#\:\$p>svg>foreignObject>section :is(pre,marp-pre) *{font-size:24px}div#\:\$p>svg>foreignObject>section :is(pre,marp-pre) div#\:\$p>svg>foreignObject>section section{--marpit-root-font-size:24px}div#\:\$p>svg>foreignObject>section img[alt~=center]{display:block;margin:0 auto}div#\:\$p>svg>foreignObject>section[data-marpit-scope-vZkjbVom] img[alt~=img1]{position:absolute;top:370px;left:650px;width:550px}div#\:\$p>svg>foreignObject>section[data-marpit-scope-RPvxhd7p] ul p{margin-bottom:0}div#\:\$p>svg>foreignObject>section[data-marpit-scope-RPvxhd7p] ul ul p{margin-top:calc(var(--marpit-root-font-size, 1rem) * 0.25)}div#\:\$p>svg>foreignObject>section[data-marpit-scope-RPvxhd7p] ul :is(pre,marp-pre){margin-top:calc(var(--marpit-root-font-size, 1rem) * 0.5)}div#\:\$p>svg>foreignObject>section[data-marpit-scope-up7t3oDQ] img[alt~=img1]{position:absolute;top:30px;left:30px;border:2px solid white}div#\:\$p>svg>foreignObject>section[data-marpit-scope-up7t3oDQ] img[alt~=img2]{position:absolute;top:220px;left:310px;width:1000px;border:2px solid white}div#\:\$p>svg>foreignObject>section[data-marpit-scope-up7t3oDQ] img[alt~=img3]{position:absolute;top:550px;left:360px;width:800px;border:2px solid white}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]{columns:initial!important;display:block!important;padding:0!important}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]:after,div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]:before,div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=content]:after,div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=content]:before{display:none!important}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]>div[data-marpit-advanced-background-container]{all:initial;display:flex;flex-direction:row;height:100%;overflow:hidden;width:100%}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]>div[data-marpit-advanced-background-container][data-marpit-advanced-background-direction=vertical]{flex-direction:column}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background][data-marpit-advanced-background-split]>div[data-marpit-advanced-background-container]{width:var(--marpit-advanced-background-split,50%)}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background][data-marpit-advanced-background-split=right]>div[data-marpit-advanced-background-container]{margin-left:calc(100% - var(--marpit-advanced-background-split, 50%))}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]>div[data-marpit-advanced-background-container]>figure{all:initial;background-position:center;background-repeat:no-repeat;background-size:cover;flex:auto;margin:0}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]>div[data-marpit-advanced-background-container]>figure>figcaption{position:absolute;border:0;clip:rect(0,0,0,0);height:1px;margin:-1px;overflow:hidden;padding:0;white-space:nowrap;width:1px}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=content],div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=pseudo]{background:transparent!important}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=pseudo],div#\:\$p>svg[data-marpit-svg]>foreignObject[data-marpit-advanced-background=pseudo]{pointer-events:none!important}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background-split]{width:100%;height:100%}
+*/div#\:\$p>svg>foreignObject>section .hljs{display:block;overflow-x:auto;padding:0.5em;background:#2E3440}div#\:\$p>svg>foreignObject>section .hljs,div#\:\$p>svg>foreignObject>section .hljs-subst{color:#D8DEE9}div#\:\$p>svg>foreignObject>section .hljs-selector-tag{color:#81A1C1}div#\:\$p>svg>foreignObject>section .hljs-selector-id{color:#8FBCBB;font-weight:bold}div#\:\$p>svg>foreignObject>section .hljs-selector-class{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-selector-attr{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-selector-pseudo{color:#88C0D0}div#\:\$p>svg>foreignObject>section .hljs-addition{background-color:rgba(163,190,140,0.5)}div#\:\$p>svg>foreignObject>section .hljs-deletion{background-color:rgba(191,97,106,0.5)}div#\:\$p>svg>foreignObject>section .hljs-built_in,div#\:\$p>svg>foreignObject>section .hljs-type{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-class{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-function{color:#88C0D0}div#\:\$p>svg>foreignObject>section .hljs-function>.hljs-title{color:#88C0D0}div#\:\$p>svg>foreignObject>section .hljs-keyword,div#\:\$p>svg>foreignObject>section .hljs-literal,div#\:\$p>svg>foreignObject>section .hljs-symbol{color:#81A1C1}div#\:\$p>svg>foreignObject>section .hljs-number{color:#B48EAD}div#\:\$p>svg>foreignObject>section .hljs-regexp{color:#EBCB8B}div#\:\$p>svg>foreignObject>section .hljs-string{color:#A3BE8C}div#\:\$p>svg>foreignObject>section .hljs-title{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-params{color:#D8DEE9}div#\:\$p>svg>foreignObject>section .hljs-bullet{color:#81A1C1}div#\:\$p>svg>foreignObject>section .hljs-code{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-emphasis{font-style:italic}div#\:\$p>svg>foreignObject>section .hljs-formula{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-strong{font-weight:bold}div#\:\$p>svg>foreignObject>section .hljs-link:hover{text-decoration:underline}div#\:\$p>svg>foreignObject>section .hljs-quote{color:#4C566A}div#\:\$p>svg>foreignObject>section .hljs-comment{color:#4C566A}div#\:\$p>svg>foreignObject>section .hljs-doctag{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-meta,div#\:\$p>svg>foreignObject>section .hljs-meta-keyword{color:#5E81AC}div#\:\$p>svg>foreignObject>section .hljs-meta-string{color:#A3BE8C}div#\:\$p>svg>foreignObject>section .hljs-attr{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .hljs-attribute{color:#D8DEE9}div#\:\$p>svg>foreignObject>section .hljs-builtin-name{color:#81A1C1}div#\:\$p>svg>foreignObject>section .hljs-name{color:#81A1C1}div#\:\$p>svg>foreignObject>section .hljs-section{color:#88C0D0}div#\:\$p>svg>foreignObject>section .hljs-tag{color:#81A1C1}div#\:\$p>svg>foreignObject>section .hljs-variable{color:#D8DEE9}div#\:\$p>svg>foreignObject>section .hljs-template-variable{color:#D8DEE9}div#\:\$p>svg>foreignObject>section .hljs-template-tag{color:#5E81AC}div#\:\$p>svg>foreignObject>section .abnf .hljs-attribute{color:#88C0D0}div#\:\$p>svg>foreignObject>section .abnf .hljs-symbol{color:#EBCB8B}div#\:\$p>svg>foreignObject>section .apache .hljs-attribute{color:#88C0D0}div#\:\$p>svg>foreignObject>section .apache .hljs-section{color:#81A1C1}div#\:\$p>svg>foreignObject>section .arduino .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .aspectj .hljs-meta{color:#D08770}div#\:\$p>svg>foreignObject>section .aspectj>.hljs-title{color:#88C0D0}div#\:\$p>svg>foreignObject>section .bnf .hljs-attribute{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .clojure .hljs-name{color:#88C0D0}div#\:\$p>svg>foreignObject>section .clojure .hljs-symbol{color:#EBCB8B}div#\:\$p>svg>foreignObject>section .coq .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .cpp .hljs-meta-string{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .css .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .css .hljs-keyword{color:#D08770}div#\:\$p>svg>foreignObject>section .diff .hljs-meta{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .ebnf .hljs-attribute{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .glsl .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .groovy .hljs-meta:not(:first-child){color:#D08770}div#\:\$p>svg>foreignObject>section .haxe .hljs-meta{color:#D08770}div#\:\$p>svg>foreignObject>section .java .hljs-meta{color:#D08770}div#\:\$p>svg>foreignObject>section .ldif .hljs-attribute{color:#8FBCBB}div#\:\$p>svg>foreignObject>section .lisp .hljs-name{color:#88C0D0}div#\:\$p>svg>foreignObject>section .lua .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .moonscript .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .nginx .hljs-attribute{color:#88C0D0}div#\:\$p>svg>foreignObject>section .nginx .hljs-section{color:#5E81AC}div#\:\$p>svg>foreignObject>section .pf .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .processing .hljs-built_in{color:#88C0D0}div#\:\$p>svg>foreignObject>section .scss .hljs-keyword{color:#81A1C1}div#\:\$p>svg>foreignObject>section .stylus .hljs-keyword{color:#81A1C1}div#\:\$p>svg>foreignObject>section .swift .hljs-meta{color:#D08770}div#\:\$p>svg>foreignObject>section .vim .hljs-built_in{color:#88C0D0;font-style:italic}div#\:\$p>svg>foreignObject>section .yaml .hljs-meta{color:#D08770}div#\:\$p>svg>foreignObject>section svg[data-marp-fitting=svg]{max-height:563px}div#\:\$p>svg>foreignObject>section :is(h1,marp-h1){border-bottom:none;color:#ECEFF4;font-size:1.6em}div#\:\$p>svg>foreignObject>section :is(h2,marp-h2){border-bottom:none;font-size:1.3em}div#\:\$p>svg>foreignObject>section :is(h3,marp-h3){font-size:1.1em}div#\:\$p>svg>foreignObject>section :is(h4,marp-h4){font-size:1.05em}div#\:\$p>svg>foreignObject>section :is(h5,marp-h5){font-size:1em}div#\:\$p>svg>foreignObject>section :is(h6,marp-h6){font-size:0.9em}div#\:\$p>svg>foreignObject>section :is(h1,marp-h1) strong,div#\:\$p>svg>foreignObject>section :is(h2,marp-h2) strong,div#\:\$p>svg>foreignObject>section :is(h3,marp-h3) strong,div#\:\$p>svg>foreignObject>section :is(h4,marp-h4) strong,div#\:\$p>svg>foreignObject>section :is(h5,marp-h5) strong,div#\:\$p>svg>foreignObject>section :is(h6,marp-h6) strong{font-weight:inherit;color:#48c}div#\:\$p>svg>foreignObject>section a{color:#88C0D0}div#\:\$p>svg>foreignObject>section hr{height:0;padding-top:0.25em}div#\:\$p>svg>foreignObject>section :is(pre,marp-pre){border:1px solid #8FBCBB;line-height:1.15;overflow:visible;background-color:#2E3440}div#\:\$p>svg>foreignObject>section :is(pre,marp-pre) code svg[data-marp-fitting=svg]{max-height:529px}div#\:\$p>svg>foreignObject>section code{background-color:#2E3440;color:#88C0D0}div#\:\$p>svg>foreignObject>section footer,div#\:\$p>svg>foreignObject>section header{margin:0;position:absolute;left:30px;color:rgba(102,102,102,0.75);font-size:18px}div#\:\$p>svg>foreignObject>section header{top:21px}div#\:\$p>svg>foreignObject>section footer{bottom:21px}div#\:\$p>svg>foreignObject>section{background:#3B4252;color:#E5E9F0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;align-items:stretch;display:flex;flex-direction:column;flex-wrap:nowrap;font-size:29px;height:720px;justify-content:center;padding:78.5px;width:1280px}div#\:\$p>svg>foreignObject>section{--marpit-root-font-size:29px}div#\:\$p>svg>foreignObject>section.lead :is(h1,marp-h1){font-size:3.1em}div#\:\$p>svg>foreignObject>section>:last-child,div#\:\$p>svg>foreignObject>section[data-footer]>:nth-last-child(2){margin-bottom:0}div#\:\$p>svg>foreignObject>section>:first-child,div#\:\$p>svg>foreignObject>section>header:first-child+*{margin-top:0}div#\:\$p>svg>foreignObject>section:after{position:absolute;padding:0;right:30px;bottom:21px;font-size:24px;color:#777}div#\:\$p>svg>foreignObject>section:after{--marpit-root-font-size:24px}div#\:\$p>svg>foreignObject>section[data-color] :is(h1,marp-h1),div#\:\$p>svg>foreignObject>section[data-color] :is(h2,marp-h2),div#\:\$p>svg>foreignObject>section[data-color] :is(h3,marp-h3),div#\:\$p>svg>foreignObject>section[data-color] :is(h4,marp-h4),div#\:\$p>svg>foreignObject>section[data-color] :is(h5,marp-h5),div#\:\$p>svg>foreignObject>section[data-color] :is(h6,marp-h6){color:currentColor}div#\:\$p>svg>foreignObject>section *{font-size:32px}div#\:\$p>svg>foreignObject>section section{--marpit-root-font-size:32px}div#\:\$p>svg>foreignObject>section .hljs-comment{color:#96a0ab}div#\:\$p>svg>foreignObject>section footer{color:#888}div#\:\$p>svg>foreignObject>section :is(h1,marp-h1){font-size:80px}div#\:\$p>svg>foreignObject>section :is(h2,marp-h2){font-size:60px}div#\:\$p>svg>foreignObject>section :is(h3,marp-h3){font-size:48px}div#\:\$p>svg>foreignObject>section :is(pre,marp-pre) *{font-size:24px}div#\:\$p>svg>foreignObject>section :is(pre,marp-pre) div#\:\$p>svg>foreignObject>section section{--marpit-root-font-size:24px}div#\:\$p>svg>foreignObject>section img[alt~=center]{display:block;margin:0 auto}div#\:\$p>svg>foreignObject>section[data-marpit-scope-Hz3K3sPR] img[alt~=img1]{position:absolute;top:370px;left:650px;width:550px}div#\:\$p>svg>foreignObject>section[data-marpit-scope-EA4tZ5bK] ul p{margin-bottom:0}div#\:\$p>svg>foreignObject>section[data-marpit-scope-EA4tZ5bK] ul ul p{margin-top:calc(var(--marpit-root-font-size, 1rem) * 0.25)}div#\:\$p>svg>foreignObject>section[data-marpit-scope-EA4tZ5bK] ul :is(pre,marp-pre){margin-top:calc(var(--marpit-root-font-size, 1rem) * 0.5)}div#\:\$p>svg>foreignObject>section[data-marpit-scope-uAAowmKA] img[alt~=img1]{position:absolute;top:30px;left:30px;border:2px solid white}div#\:\$p>svg>foreignObject>section[data-marpit-scope-uAAowmKA] img[alt~=img2]{position:absolute;top:220px;left:310px;width:1000px;border:2px solid white}div#\:\$p>svg>foreignObject>section[data-marpit-scope-uAAowmKA] img[alt~=img3]{position:absolute;top:550px;left:360px;width:800px;border:2px solid white}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]{columns:initial!important;display:block!important;padding:0!important}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]:after,div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]:before,div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=content]:after,div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=content]:before{display:none!important}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]>div[data-marpit-advanced-background-container]{all:initial;display:flex;flex-direction:row;height:100%;overflow:hidden;width:100%}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]>div[data-marpit-advanced-background-container][data-marpit-advanced-background-direction=vertical]{flex-direction:column}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background][data-marpit-advanced-background-split]>div[data-marpit-advanced-background-container]{width:var(--marpit-advanced-background-split,50%)}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background][data-marpit-advanced-background-split=right]>div[data-marpit-advanced-background-container]{margin-left:calc(100% - var(--marpit-advanced-background-split, 50%))}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]>div[data-marpit-advanced-background-container]>figure{all:initial;background-position:center;background-repeat:no-repeat;background-size:cover;flex:auto;margin:0}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=background]>div[data-marpit-advanced-background-container]>figure>figcaption{position:absolute;border:0;clip:rect(0,0,0,0);height:1px;margin:-1px;overflow:hidden;padding:0;white-space:nowrap;width:1px}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=content],div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=pseudo]{background:transparent!important}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background=pseudo],div#\:\$p>svg[data-marpit-svg]>foreignObject[data-marpit-advanced-background=pseudo]{pointer-events:none!important}div#\:\$p>svg>foreignObject>section[data-marpit-advanced-background-split]{width:100%;height:100%}

From Input to Injection

Practical Lessons from HKIRC CTF


@@ -170,7 +170,7 @@

1.3 — Python Format String Inject

Ultra Simplified Example:

-
PASSWORD = 'password_5910f7f523'
+
PASSWORD = 'password_5910f7f523cd780c67'
 
 class Car:
     def __init__(self, make, year, color):
@@ -179,7 +179,7 @@ 

1.3 — Python Format String Inject def __str__(self): return f'Car(make={self.make},year={self.year},color={self.color})' -print(input().format(Car("Toyota", 2020, "Blue"))) +print(input('Input: ').format(Car('Toyota', 2020, 'Blue'))) # {0.__init__.__globals__[PASSWORD]}

    @@ -191,7 +191,7 @@

    1.3 — Python Format String Inject
    From Input to Injection: Practical Lessons from HKIRC CTF   •   2024 Aug. 14

-
+

No problem!

{user.__init__.__globals__[__loader__] \
  .__init__.__globals__[sys].modules[HealthyBMI.settings] \
@@ -209,7 +209,7 @@ 

1.3 — Python Format String Inject
From Input to Injection: Practical Lessons from HKIRC CTF   •   2024 Aug. 14

-
+

Real Problems, Real Vulns

Various Python format-string CVEs:

@@ -275,7 +275,7 @@

Demo Walkthrough

GG!

From Input to Injection: Practical Lessons from HKIRC CTF   •   2024 Aug. 14
-
+

img1
img2
img3

@@ -318,6 +318,7 @@

Resources

  • Linux File System - /proc
  • PHP Parameter Tampering and Request Injection
  • HackTricks – Python Read Gadgets • Python Format String
  • +
  • Python Format String Syntax

  • bsqli.py

    @@ -333,11 +334,17 @@

    Resources

    Hope you enjoyed!

    npx @marp-team/marp-cli@latest --theme-set nord.css --image jpeg -o from-input-to-injection.jpg . +

    Thumbnail +npx @marp-team/marp-cli@latest --theme-set nord.css --image jpeg -o from-input-to-injection.jpg . +Server npx @marp-team/marp-cli@latest --theme-set nord.css --html . -npx @marp-team/marp-cli@latest --theme-set nord.css --html -o 2024-08-14-from-input-to-injection.html --title 'From Input to Injection: Practical Lessons from HKIRC CTF' --description 'Casual sharing on interesting techniques we picked up from HKIRC CTF: arbitrary file reads, PHP parameter tampering, and Python format string injection. We also explore how to automate boolean SQL injection for speed and fun.' --url https://trebledj.me/slides/from-input-to-injection/ --og-image /img/slides/from-input-to-injection.jpg pres.md

    <div data-marpit-fragment> +HTML +npx @marp-team/marp-cli@latest --theme-set nord.css --html -o 2024-08-14-from-input-to-injection.html --title 'From Input to Injection: Practical Lessons from HKIRC CTF' --description 'Casual sharing on interesting techniques we picked up from HKIRC CTF: arbitrary file reads, PHP parameter tampering, and Python format string injection. We also explore how to automate boolean SQL injection for speed and fun.' --url https://trebledj.me/slides/from-input-to-injection/ --og-image /img/slides/from-input-to-injection.jpg pres.md + +PDF +npx @marp-team/marp-cli@latest --theme-set nord.css --html -o 2024-08-14-from-input-to-injection.pdf --pdf --allow-local-files .

    <div data-marpit-fragment> Reference: [Linux File System - `/proc`](https://tldp.org/LDP/Linux-Filesystem-Hierarchy/html/proc.html) </div>

    But on a related note...

    PHP types are more brittle than you think.

    References: [Read Gadgets](https://book.hacktricks.xyz/generic-methodologies-and-resources/python/python-internal-read-gadgets) • [Python Format String](https://book.hacktricks.xyz/generic-methodologies-and-resources/python/bypass-python-sandboxes#sensitive-information-disclosure-payloads)

    Django app!

    FrappeFramework: Low code SAAS. Think of it as a CMS.

    Questions!??

    Who has discovered and exploited this in engagements?

    - Ramble

    Walkthrough SQLite Demo:

    - Basic PoC

    - PoC with UNICODE/SUBSTRING

    - PoC with script

    Share about that engagement with multiple subsidiaries.