Server-Side Template Injections Explained

[@brunocarrazza500]

I missed you so much, you are such a inspiration for me continuing researching and learning hacking stuff

[@DrProductivity]

Dude I love your videos! I am a Software Engineer and you videos gave me an easy first look into some security topics

[@RoiEXLab]

Love the Mr. Robot reference

[@HaxorBird]

Long time no see :]

[@bhoomikag2883]

Crazy! Great content and loved the background music XD

[@uhhuhh9996]

Solid video, never thought of making function calls from within templates. You explained it well, and the drawing make it super easy to follow along! Keep it going man

[@sourabhkarjee2566]

glad to see you back after a while..be continue as soon as you can

[@gFamWeb]

I've watched a handful of videos on this channel so far and the majority of them were new methods of hacking I was completely unaware of! great job!

[@hydejel3647]

Great content! Been waiting for another video for a while now, but it's finally here! :D

[@dimasveliz6745]

This is so far, one of my favorite internet videos. Amazing to this channel popped up on my KZbin feed. Thanks for sharing, brilliant video!

[@jemand771]

you give off a kind of LiveOverflow vibe and i love it

[@wonggames9097]

Thanks a LOT for that python knowledge! I'm stuck on a python CTF challenge for a long time, and now i made a huge step. Still not done but now I have acces to sys, not to os.

[@kh4l3d30]

literally this is the best channel in KZbin

[@loveyadav1201]

I like you attitude,your accent and voice and also the content you deliver keep making such things for us thank you

[@Parrotassassin15TechToker]

you are now my new fav channel for when I go back to the basics you make it so much more fun!

[@joshaprior3699]

Missed you

[@m4rt_]

0:37 I like the Mr. Robot names you used in there

[@zipp5022]

the quality of these videos are just excellent, lots of love dude, keep posting more like these :)

[@Tazzra]

Thank you. I have been struggling to get my head around this 1 for days

[@rogervanbommel1086]

Can this be bypassed by exec(compile(“import os; os.system(‘id’)”))

[@ferr3iro145]

That was amazing And im not even a Python coder

[@micr0xchip0xverflow6]

So glad to see you are back!!! Missed your videos!

[@0xddcce1]

0:33 nice reference

[@MrKristian252]

Nice of you to play my all time favorite song ever in the background

[@venvanman]

I work with flask professionally I never did this error but this is good to keep in mind thank you

[@aprilmintacpineda2713]

Lesson: sanitize user input. Golden contents!

[@moeg3457]

The most interesting things is the beautiful simple website style design you making. I wonder what are you using to make these simple website (Front-end) for the back-end its clear you are using python flask.

[@PwnFunction]

I mostly use Python with Flask for backend because it has a very simple boilerplate code to get started with. For the frontend, I mostly write CSS from scratch. It's probably not the best thing, I should prolly write a small CSS library to keep the styles consistent across videos, but they look mostly the same because I have memorized styles with colors I usually go with.

[@moeg3457]

​@@PwnFunction Thank you so much for the reply. I really appreciate that.

[@faizannehal1]

The king is back

[@nycode8337]

0:36 i like the Mr Robot allusions

[@al62796]

Those tweets on the example website are too funny

[@hexrays6150]

This is so well done. Great videos on your channel.

[@tymekl1509]

Cool video, but When you say that jinja limits the templates, so that you cannot import, instead of doing "import os; os.system('id')", you could try "__import__('os').system('id')". [ I don't know if that works, just a suggestion to include in the video ]

[@PwnFunction]

Yes, I've tried using the special methods, jinja errors out, doesn't seem to let you import at all :(

[@muzammilkayani777]

glad to see you back

[@hackingguy]

Please Make Alot Of Videos! I love learning things like this! 🤩

[@randomguy3784]

Top notch presentation! 👌 Keep up the great work man!

[@SayantanHack]

Such a great video in very low audio humiliate the home theater`s full vol sound.

[@engineerscodes]

Seen something very useful after months... Thanks man

[@AshChambers21]

This was eyeopening. Well done. Subbed.

[@PsiensGate]

DAAAAD WHERE HAVE YOU BEEN I MISSED YOU

[@ashishf6]

like the way you explained and this theme for displaying code

[@_Slaze]

If you want to know which class of __subclasses__() contains sys/os, you can simply execute the following code and get the position of the module in the subclasses list: class_l = ''.__class__.__base__.__subclasses__() for i, val in enumerate(class_l): try: val.__init__.__globals__['sys'] print(i, val) except: pass

[@alfatihflowlesk4010]

man please dont stop ur videos please

[@typicaljohan716]

Love your videos man!

[@checkmate6732]

great work!! short and sweet, keep it going please!

[@pratyushbehere3580]

Dude this is cool. Really well explained

[@johannestorgilsson5467]

Love the Mr. Robot references.

[@sumedhvangara7368]

hes backkkkk!!!!!11!!!!!11!1!

[@kawakami_idv]

The math teacher I’ve always wanted

[@Serverfrog]

I think this would be good to watch after the entire Log4J part :P

[@erolramacik2627]

Nice video dude keep up

[@brijspy]

The legend is back

[@jkk1337]

In germany 7*7 is 'feiner sand' (fine sand) cause 7 sounds like the verb to sieve

[@ap3660]

LOL I FLINCHED WHEN HE SAID "SUPRISE MOTHER FU". pls keep teaching

[@jomy10-games]

Very interesting video. Also perfect length!

[@BehradJi]

That was an amazing video! Thank you.

[@andricozach]

Your videos are amazing and hilarious! Keep it up! :)

[@xscorp382]

Such an awesome explaination. Thanks man

[@ahmadshauqi8821]

Immediately press like button before watching...

[@anik6393]

Great explaination with great art works

[@GarthHumphreys]

Thanks for sharing this, it's very insightful! Looks like it's time for me to review my code lol

[@M4lch4t]

You're back!😄

[@887310954]

boy o boi , i got so many bugs in live applications after learning basics from here

[@lavleshjoshi1465]

Simple and Solid Explanation ❤

[@onkarkoli8621]

wonderful video mate ... explained very well

[@chiragbablani8325]

rap @ 6:13

[@holybugx]

Welcome Back !

[@kallikantzaros]

3:15 British people getting stabbed like: "Oit there mate, bit rude to put that knoife in me chest innit?" LMAO

[@rahulrajkumar1110]

Best explanation!

[@M4lch4t]

7*7=SSTI 😅 Another great video

[@muhammedalzureedi9588]

Very Educational video keep it up

[@vimeostyle7095]

Greeeeeat 🎉

[@antoniotorga5371]

this video is awesome thanks!

[@falcongecon3430]

Love you so much, thanks do great video's :D

[@kinggio4553]

Thanks ❤️

[@aneesh219]

Lov ur all topics 😍😎😎

[@harshjaiswal1245]

Loved it!!! Great video!

[@matthias7534]

I love those Mr Robot references 🤣

[@_timestamp]

Well made video!

[@caseylux7246]

I love you man

[@DHIRAL2908]

3:15 Ah I see someone saw the Pewds video haha!

[@Sadeq666]

Too good

[@mohanraj-kr9xg]

Your intro music is cool

[@prabhatyadav8189]

Great explanation...you are amazing...

[@ANKITPATEL-ju7ro]

Thanx alot for the awsome videos brother.

[@aneeshnadh5377]

Great teaching, expecting more... From u

[@hawk_wheels]

Missed you !

[@inusahrauf1810]

I made it! Thanks.

[@bap9394]

Very useful thank you for this

[@N10-b8f]

Damn. This is so cool!

[@Yukinebi]

Sometimes the easiest example you can come up with is not the best one.

[@Love-do6ei]

Bril jus bril bro! ❤️

[@oldbootz]

Haha catch_warnings on line 420 and the one with the vuln... I smell a backdoor?

[@leetcsl]

thanks bro for that video!

[@RajvirSingh1313]

wappalyzer would be useful for a hacker as it can provide the tools and the languages and the framework used a in web app making easier to guess

[@mr.d.editzx]

The way python sir enters😌😂

[@sotig.9857]

Awesome Content 🔥

[@salluc1712]

thank you

[@xetera]

Technically the reason why the first attempt didn't work was because you had a statement in a place where jinja expected an expression but yes __ import __ also doesn't work in this case

[@madghostek3026]

New video yaaayyy