This article explains how to perform white-box penetration testing on a Python web application running in a Docker container. In this white-box pentest, we will go through how to debug Python in VS Code in order to track our payloads throughout the process, and understand how security filters can hide vulnerabilities in plain sight.

Improve future black-box testing with code analysis

Visual Studio Code aka VS Code (or your preferred IDE)

, you can install the Python debugger extension from the extension tab on the left-hand side. Simply search for "Python debugger" and install it:

Our project will use the following file structure:

Certain files are extra-important when debugging Python, and must be added or modified. The files below contain the final file content:

This is the vulnerable Python web application that we will run in a dockerised environment.

In our supervisord.conf file the only thing we need to modify is the 

python -m debugpy --listen 0.0.0.0:5678 --wait-for-client /app/6-ssti-classic.py

 to make sure our debugger listener starts once our Docker container boots up.

This will be the configuration used to tell Visual Studio Code how to connect to the Python Debugger running in a Docker container.

As well as building the Docker image, the Dockerfile installs and activates our Python debugger inside the Docker container.

To this file we will add a network called debug-net. We will then add a static IPv4 address to our Python web application: 172.20.0.111. Finally, we will open Python's debugger port: 5678.

This setup allows us to more effectively connect and communicate with the Python debugger running in the Docker container.

To validate that our setup is working properly, we need to start our Docker container, connect to Python Debugger, set up breakpoints in Visual Studio Code and, finally, perform a request to the web application to see if the debugger stops at these breakpoints.

Usually, you want to start this command in the background (using the argument 

), but if you’re unfamiliar with Docker, I recommend running the command as it appears above so that you can see the logs. Once the Docker container has finished the build process and starts, we notice this message from our Python debugger:

This message shows that our Docker started successfully and that Python’s debugger is now listening for a connection and primed to start debugging Python.

Now let's set up some breakpoints inside the Python web application code located in Visual Studio Code!

We can set up breakpoints by clicking on the red dot that appears when you hover over the line number.

Inside VS Code, go to the debugger section on the left-side panel (shortcut: 

). Once inside the debug section, press the green arrow icon located at the top (

With the debugger in Visual Studio Code is up and running and connected to Python's debugger, you should now see in the terminal that the Python web application is running.

Now our debugger is connected, it's time to perform a HTTP request to trigger the Visual Studio Code breakpoints. We can use the command line interface (CLI) tool cURL to send a GET request to our web application:

If everything goes as expected, you should not get a response back directly. Instead you should have some code highlighted inside VS Code that proves the debugger is working and that it stopped at the first breakpoint:

Now we know our setup and debugger are working as expected, it's time for the bug hunt.

As you may have already noticed, our web application is vulnerable to a server-side template injection (SSTI) vulnerability. Let’s try an SSTI payload: 

Next we analyse the request we sent containing our payload in the 

 GET parameter. In Visual Studio Code, we can see a breakpoint hit:

We then click the blue, triangular arrow at the top (the first arrow from left to right):

Take a close look at the debug side panel to the left: our payload, which was included in the GET parameter 

 Python variable. But you might also notice that the payload has been HTML-escaped – so in theory, if the web application is vulnerable to a SSTI, we should get an error.

Let's move to our next breakpoint to see what final input is given to the template engine:

, is HTML-escaped by the Python function 

And as predicted, we got a 500 server error in our HTTP response!

To confirm that the vulnerability now exists, we can use the payload 

 and see how Python reacts this time using VS Code's debugger:

Looking at our debugger result, we can see that everything looks good!

 appearing in the HTTP response from our vulnerable web application!

Now that we understand how our payload is being escaped and inserted, we can adapt the payload to exploit the web application and achieve a remote code execution (RCE)!

Because our payload is HTML-escaped before it is inserted into the template string, we cannot take advantage of quotes. And without being able to write the command as a pure string, it will be more challenging to provide a system command. Luckily, we have a solution: Read ‘

Limitations are just an illusion: Advanced server-side template exploitation with RCE everywhere

’ to learn how to achieve RCE without using quotation marks in your payload.

, which converts a hex decimal value to its string character and use this to generate a string. As an example, we can generate the 

Then we can use this string as our argument in Python's 

 function, which will execute our system command and give us RCE:

This results in a successful remote code execution on our web application!

Below are three common Python weaknesses associated with the Python programming language.

: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Although prototype pollution vulnerabilities mainly affect the JavaScript programming language, Python can contain flaws that fall into this category, namely 

: Improper Neutralisation of Special Elements Used in a Template Engine

While this vulnerability is not specifically related to Python, it is important to note that most Python template engines are very powerful. Since they typically provide the ability to run pure Python code within the template engine, there’s a particularly significant risk of high-impact vulnerabilities.

Any programming language can be vulnerable to this CWE. With Python, absolute path traversal can arise when developers use 

 insecurely. This function is often used when joining paths and filenames, but many developers don’t realise that if 

 contains a filename with a front-slash prefix such as 

, it may have unexpected and unwanted results.

As we hoped, our SSTI payload generated a HTTP response containing a 500 server error. By using the debugger, we discovered that the payload failed not because of an error in the payload itself, but because the server HTML-escaped the payload, rendering it invalid.

As a takeaway for future black-box testing, it’s worth testing out multiple payloads with various tweaks when trying to detect the same vulnerability. Deploying a wide variety of payloads is a great way of detecting possible changes from the back-end server and to avoid false negatives.

Debugging your target’s source code helps you to track executed code triggered by the client (attacker). The process we’ve detailed can optimise your testing flow and surface behaviours that help you identify how user input is being handled.

If the server HTML encodes your SSTI payload and makes it invalid in the execution process, it is important to understand how this will affect your future exploitation of the vulnerability. To this end, practising debugging and code analysis on vulnerable targets will teach you how different filters are used and how various programming languages implement protection mechanisms.

White-box penetration testing: Debugging for Python vulnerabilities

Generous bounties, technically stimulating scopes and the feel-good factor of helping to secure critical infrastructure that underpins a free and open internet – sound appealing, bug hunters?

You can enjoy these benefits by hunting on the seven (so far) public Bug Bounty Programs operated by the Sovereign Tech Fund (STF), which invests in open digital infrastructure to ensure a resilient and sustainable open source ecosystem.

Your hacking skills, together with support from the STF, are particularly invaluable to these volunteer-run open source projects, given their vital role infrastructurally or for critical dependencies. Just consider the downstream impact of the 

 to see the importance of effective vulnerability management in this realm.

The location of Log4Shell, the Log4j Java logging framework, is now among the STF’s Bug Bounty Programs, alongside ntpd-rs, GNOME, systemd, OpenPGP.js, Sequoia PGP and CycloneDX Rust Cargo.

All seven programs are currently offering rewards up to 

 for critical vulnerabilities. High-severity flaws command bounties up to 

The generous bounties – among the highest on YesWeHack – reflect the unusual and challenging nature of many of the targets. Scroll down and check out these programs to see if the scopes align with your hacking expertise.

Tara Tarakiyee, a technologist at the STF, comments: 

“Our societies increasingly rely on open source software as critical infrastructure, and it takes a lot of effort to keep that infrastructure safe. Which is why STF is committed to fostering the community of security researchers looking to use their skills to secure the open source ecosystem in the public interest through programs like the 

Open-source Bug Bounty Programs from the Sovereign Tech Fund

These seven public Bug Bounty Programs are currently active. With the Sovereign Tech Fund having numerous active investments – also including Drupal, PHP, Fortran, GNU libmicrohttpd and Python Package Index – and on the lookout for more, the organisation may well be a source of new hunting opportunities in the not-too-distant future.

The site of arguably the most significant vulnerability of all time – Log4Shell – owing to its severity and the ubiquity of this Java logging framework. 

 comprises an API, its implementation, and components to facilitate deployment for various use cases.

Qualifying vulnerabilities (at the time of writing): 

log injections, log event loss, memory safety, remote code execution, deadlocks, DoS.

 for up-to-date scopes, qualifying/non-qualifying vulnerabilities and other rules.

 is an open-source implementation of the Network Time Protocol written in Rust, with support for the Network Time Security protocol and a focus on exposing minimal attack surface.

Qualifying vulnerabilities (at the time of writing):

 Remote code execution; remote denial of service (excluding protocol limitations); privilege escalation; misuse of cryptographic primitives; and arbitrary clock modifications, using only NTS sources, controlling at most a minority of the NTS sources.

 is a project to read, write and generate CycloneDX SBOMs. It comprises cyclonedx-bom, a Rust library for reading and writing CycloneDX SBOMs from/to Rust structs, and cargo-cyclonedx, a Rust application that leverages cyclonedx-bom to generate CycloneDX SBOMs for Cargo-based Rust projects.

 Remote code execution, remote denial of service, local and unprivileged denial of service, privilege escalation, memory safety issues, sandbox or security boundary bypass, arbitrary file read/write operations, code injection vulnerabilities, insecure deserialization, cryptographic implementation flaws, integrity check bypass, dependency resolution vulnerabilities, exposure of sensitive information in logs, compromise of signed SBOMs (e.g., signature verification failures), manipulation of SBOM content leading to incorrect or incomplete data, misconfiguration vulnerabilities, and insecure handling of command-line arguments and environment variables.

Fully featured desktop environment and application platform for Linux. Used with the likes of Ubuntu, Fedora, RHEL and Tails and in security-critical contexts by activists, journalists, corporations and governments, among other users. The 

 Bug Bounty Program began with two critical scopes, GLib and libsoup, but there is enormous scope for growth with the GNOME desktop consisting of hundreds of modules.

Memory safety issues, denial of service, undefined behavior leading to a security vulnerability, race conditions, missing validation of untrusted inputs, privilege escalation, cryptographic problems, exfiltration of confidential material, and supply chain issues.

A suite of basic building blocks for a Linux system. Among other features, 

 provides aggressive parallelisation capabilities, socket and D-Bus activation for starting services, on-demand starting of daemons, tracking of processes using Linux control groups, maintenance of mount and automount points, and implementation of transactional, dependency-based service control logic.

UEFI SecureBoot bypasses, remote code execution, remote denial of service, local and unprivileged denial of service, privilege escalation, sandboxing bypass, login prompt/password check bypass, disk encryption keys leaks, misuse of cryptographic primitives, leaking user logs to other unprivileged users, and signed dm-verity compromise.

 is a JavaScript library implementing the OpenPGP standard for message encryption and signing. OpenPGP is typically used for end-to-end encrypted email, signing of git commits and software releases, and encrypted file storage, among a variety of other applications.

 Where OpenPGP.js: incorrectly encrypts a message, causing (part of) it to be decryptable by an attacker; uses an insecure algorithm (by default) to encrypt a message, causing (part of) it to be decryptable by an attacker; incorrectly decrypts or signs the message, causing (part of) the private key to be extractable by an attacker; returns unauthenticated data (by default), potentially causing EFAIL-style vulnerabilities; incorrectly verifies an invalid signature; fails to parse a compliant OpenPGP public key, possibly causing the application or user to send the message in cleartext instead.

 provides secure communication and authentication in the OpenPGP arena. “We are committed to protecting the privacy and security of our users with a particular emphasis on the most vulnerable people in our society: activists, journalists, lawyers and their clients,” reads the program introduction.

Memory safety issues, denial of service, undefined behaviour leading to a security vulnerability, injection attacks into human-readable and machine-readable output, authentication bypasses, creation of cryptographic artifacts using high-level interfaces that break or undermine the properties of cryptographic algorithms, invalid reasoning about OpenPGP certificates, exfiltration of confidential material, diversion of packet streams with respect to another major OpenPGP implementation, improper use of cryptographic primitives, and improper handling of secret key material.

 invests in open digital infrastructure projects in order to strengthen open source security, resilience and technological diversity. Founded in 2022, the fund is financed – to the tune of €17 million for 2024 – by the German Federal Ministry for Economic Affairs and Climate Action.

 in 2023 to help time-poor open source maintainers prevent and patch vulnerabilities through technical debt reduction, secure code audits and Bug Bounty Programs managed by YesWeHack. 

, meanwhile, saw an initial three successful applicants – developers, contributors or maintainers – given €300,000 to spend on creating or improving developer tooling, production security mechanisms and project documentation for their Free and Open Source Software (FOSS) components over a four- or eight-month period. The Sovereign Tech Fund is also piloting a 

 under which overworked and hitherto unpaid maintainers of critical open source components will be paid for their work.

These are important initiatives when you consider how, according to 

, 96% of codebases contain open source, applications have 526 open source components on average, and 84% of codebases contain at least one open source vulnerability.

Hacking for €10k rewards and a secure open source ecosystem: Bug Bounty opportunities from the Sovereign Tech Fund

This article explains some novel techniques for exploiting 

 (SSTIs) with complex, unique payloads that leverage default methods and syntax from various 

. Even better, we will show how to do so without needing any quotation marks or extra plugins within the templates. All server-side template injection payloads detailed below can achieve 

By default, many template engines have auto-escape enabled or perform HTML escape before the template rendering process. This sometimes makes our exploitation scenario much more difficult because of quote filtering used to render string-based data. Without string-based data in some form, RCE is significantly harder to achieve for some template engines, 

 being a notable example. For others, however, exploitation remains relatively simple even without the use of quotation marks. Our 

 exploit was simplified, for instance, by the availability of the 

The goal of our research was simple: to create payloads for some of the most popular template engines with the impact being an RCE. The payloads should not rely on any resources, such as HTTP parameters, outside of the payload itself. Achieving this would ensure the payload works in as many exploitation scenarios as possible.

Our research attempted to achieve a payload in relation to our goal on the following template engines:

As we said before, all payloads use only the default functions and methods from the template engine and don’t take advantage of any quotes or resources available outside the template engine itself, such as parameters in the HTTP request. Despite these limitations, all payloads  can be used to achieved a RCE on an application vulnerable to a server-side template injection.

, the default template engine used within Flask, is very powerful since it makes it possible to write and execute pure Python code.

To write a simple string, we can write this payload (note: index values may vary):

, which contains all global variables accessible to that function. This is then converted to a string with the help of the 

 method. To build our string, we take advantage of index positions 1786 and 1788 from the converted 

 string, which finally returns the string: id.

We can now leverage this technique to build a payload that performs a remote code execution and runs system command 

A similar payload structure can be used to exploit one of the 

 that used Jinja2 as it's template engine and filtered out all quotation marks.

 is another template engine compatible with Python and is used by default by Python frameworks Pyramid and Pylons.

In Mako, a payload such as the one below will generate the string 

We can then use this crafted string within Python’s 

Although you could also use a payload like the one below, it requires the use of "less-than" (

) characters – putting it outside the scope of our research objective:

, the PHP template engine, was one of the most challenging template engines to find a working payload for. The biggest challenge of all was making a string from its built-in and default configurations. 

Fortunately, I managed to craft a payload by leveraging the 

 variable. Finally, I nested them together, which resulted in a successful payload:

I also discovered an interesting payload that takes advantage of the built-in 

This payload allows you to achieve RCE if a

 template engine has performed a double rendering process

 function to generate a string based on the Hexadecimal value. We then use the variable modifier 

 to concatenate our other generated chars and complete the string. The resulting string 

Similar to Twig, we can use the function 

 to execute our generated string and achieve RCE:

 is the default template engine for the Laravel framework. We can use the 

 function to convert hexadecimal values to characters, insert the characters into an array map, and use 

 to join all generated characters into a string.

Combined with the string generated from our previous payload, we can use 

 command, which results in remote code execution:

 is a Java-based template engine mainly used in the Grails framework. It’s a powerful engine. In Groovy, you can craft a string using either of the following methods:

 function to run the resulting string-based command as a system command:

If you prefer the payload to have no spaces, you can always use a multi comment (

 is a popular template engine used in Java-based applications and is supported by a variety of frameworks, including Spring and Apache struts.

Our efforts to generate a suitable string in FreeMarker led to the discovery of a pretty neat function: 

. This function converts int based values into a string – but not in the way you might expect from functions such as 

, etc. This is the same logic that you can see in column labels in spreadsheet applications (like Excel or Calc). The lowest allowed number is 

. There's no upper limit. If the number is 

 or less or it isn't an integer number then the template processing will be aborted with error.

So if you wanted a string that represents the letter "

", meanwhile, can be generated with the payload:

By using this method, you can build a string that can be used to create a payload such as the following, with the impact being RCE:

 is a powerful template engine that can run pure 

 code. The ability to generate a string by taking full advantage of the 

 programming language opens up a wide range of payload possibilities.

For instance, the following payload generates the string 

If you then want to run this command as a system command, you can use 

Achieving RCE in various popular template engines in this manner – with unique payloads that use only built-in methods/functions – shows just how much you can do with a program even when limited to using minimal resources.

There are still plenty of template engines that I personally have yet to investigate. For anyone interested in building on my research, I believe there are payloads following the same structure that could also achieve RCE in the template engines not covered here. I would say that is a good way to start.

 made by Hackmanit! They made the payload testing a lot easier!

Finally, I would like to thank the guys at SCH Tech for their research: 

Limitations are just an illusion - advanced server-side template exploitation with RCE everywhere

object relational mapper (ORM) leak vulnerabilities

 by Elttam kicks off our latest roundup of InfoSec news and hacking writeups.

ORM leak flaws apparently occur when ORMs fail to validate user inputs, potentially resulting in the exposure of sensitive data. 💻 

 of Elttam’s research – described as “super-interesting” with “tons of potential for further research” 

 – focuses on the Django ORM and relational filtering attacks. 

, “a beautiful example of abusing framework features to make timing attacks that work in the wild”. 🔥

, meaning moderators have deemed the research truly novel in the realm of web security. 🚀

The same applies to Doyensec research that discovered that cross-site request forgery (CSRF) remains a viable vector in today’s applications despite browsers having been considerably hardened against CSRF (notably through 

). 🧐 The vulnerability research firm successfully 

client side path-traversal “to resuscitate CSRF

 for the joy of all pentesters” and unearth vulnerabilities in major web messaging applications, 

wrote Doyensec researcher Maxence Schmitt

. The research is documented more extensively in a whitepaper and has spawned a 

 “that provides advanced capabilities and automation for finding and exploiting Client-Side Path Traversal”. 👌

Other groundbreaking research to satisfy the exacting criteria of r/websecurityresearch recently includes: 

extending browser extension messaging chains with native messaging to achieve ‘universal code execution’

; Doyensec’s Viktor Chuchurski on how inadequate concurrency control in databases can 

“that is often overlooked by pentesters”, 

Assetnote co-founder and CTO Shubham Shah, meanwhile, 

 to be “one of the most critical exploit chains in the history of @assetnote”, no less. 😮 The researcher in question praised ServiceNow’s security team as being “excellent to work with” in securing the more than 40,000 potentially affected instances.

 writeup from 15-year old (!!!) researcher 

, specifically leading ‘from PDF.js font-injection to All-platform Electron exposed ipcRenderer with listened BrokerBridge RCE’; PortSwigger’s Zakhar Fedotkin showing “

abuses widget annotations to create render discrepancies

, and share the code so you can generate your own”; Sonar’s Stefan Schiller on the value of

 when serving HTML documents to reduce the risk of XXS bugs; and ‘

how we discovered the AWS Organization ID for any AWS Account

’ from the CTO and co-founder of Tracebit. 😎

Over in LLM world, a former Apple engineer has 

 “an almost complete lack of bug reporting infrastructure from the LLM providers” after documenting his efforts to report a delirium-inducing prompt that he dubbed “LLM kryptonite”. 🦸 In a 

, Mark Pesce had recounted how he had induced “every chatbot I could access” bar Anthropic’s Claude 3 Sonnet into descending into a “

, LLM vendors came under fire for apparently declining to acknowledge issues while surreptitiously deploying “behind-the-scenes patches”. 😲

As well as hosting a live Bug Bounty with L’Oreal 💄 (see the highlights video below or 

), YesWeHack had a booth at leHACK in Paris last month and can relay some interesting insights from the conference track at France’s biggest hacker con.

 and thinker on InfoSec, cyber warfare and internet privacy, was reassuring on the topic of 

resisting manipulation by AI and malign online actors

If humans seem increasingly helpless to resist their minds being 'hacked' by ever-more sophisticated algorithms, then who better to show how to fight back than the human hackers? 

Schwartau said a cybersecurity mindset could inoculate us against the algorithmic manipulations that keep us scrolling, clicking and feeling negative emotions – anger, disgust – that most effectively drive social media ‘stickiness’. 

“Apply cybersecurity to it and there is hope,” he said. The speaker urged humanity to “take a pause” and engage in slow, deliberate and conscious 

. 🧠 He also recommended resources for building resilience against misinformation and disinformation, such as the 

. Schwartau also lamented how while the UK and EU have numerous studies or initiatives on countering misinformation, the US has none – the most recent, the Stanford Internet Observatory, had closed down. 😯

, a lock-picker extraordinaire, offered some fascinating insights into the vulnerabilities of physical locks. 🔒 

How many of the lessons he drew apply to digital security? “Always look for simple solutions to what look like complex problems” when vuln hunting for instance. “Clever does not mean secure,” is another. The author of a 

The YesWeHack Blog

White-box penetration testing: Debugging for Python vulnerabilities

White-box penetration testing: Debugging for Python vulnerabilities

Hacking for €10k rewards and a secure open source ecosystem: Bug Bounty opportunities from the Sovereign Tech Fund

Limitations are just an illusion - advanced server-side template exploitation with RCE everywhere

White-box penetration testing: Debugging for Python vulnerabilities

ORM leaks, CSRF is alive, lockpicking lessons – ethical hacker news roundup

Partial SolarWinds reprieve, CrowdStrike lessons, LLM kryptonite – OffSec roundup for CISOs

Dojo challenge #34 winners!

ORM leaks, CSRF is alive, lockpicking lessons – ethical hacker news roundup

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

White-box penetration testing with Xdebug: Debugging for PHP vulnerabilities

L'Oréal lauds live Bug Bounty success at LeHack 2024

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

DON'T WAIT FOR THE THREATS TO STRIKE

Produits

Chercheurs

Ressources

A propos

Suivez-nous