tag:blogger.com,1999:blog-2987759532072489303.post6407027118464601986..comments2024-03-27T13:24:43.721+08:00Comments on Orange: Uber 遠端代碼執行- Uber.com Remote Code Execution via Flask Jinja2 Template InjectionOrange Tsaihttp://www.blogger.com/profile/02779986309373771735noreply@blogger.comBlogger7125tag:blogger.com,1999:blog-2987759532072489303.post-74823518932136261102020-02-22T16:14:19.726+08:002020-02-22T16:14:19.726+08:00Amazing Orange! Amazing Orange! HUNTERhttps://www.blogger.com/profile/00909093146217958687noreply@blogger.comtag:blogger.com,1999:blog-2987759532072489303.post-35600265986395636492017-06-08T05:11:21.652+08:002017-06-08T05:11:21.652+08:00hey there ak1t4, i want to learn how he did it, bu...hey there ak1t4, i want to learn how he did it, but it don't understand a bit here.pwntheworldhttps://www.blogger.com/profile/08146513504215819100noreply@blogger.comtag:blogger.com,1999:blog-2987759532072489303.post-15792578347994342722017-03-04T04:17:42.680+08:002017-03-04T04:17:42.680+08:00i dont understand a shit, english orange! english!...i dont understand a shit, english orange! english!<br />Anonymoushttps://www.blogger.com/profile/08788547055088336998noreply@blogger.comtag:blogger.com,1999:blog-2987759532072489303.post-22417439129400822652016-08-16T20:15:57.775+08:002016-08-16T20:15:57.775+08:00Thanks for your attention.
You are right, both of ...Thanks for your attention.<br />You are right, both of patterns are ok, it just my personal habit :POrange Tsaihttps://www.blogger.com/profile/02779986309373771735noreply@blogger.comtag:blogger.com,1999:blog-2987759532072489303.post-76451409072146618272016-08-16T20:09:21.803+08:002016-08-16T20:09:21.803+08:00Great job, Orange! I wanna ask you about Uber SQl ...Great job, Orange! I wanna ask you about Uber SQl injection https://hackerone.com/reports/150156<br /><br />In particular:<br /><br />{"user_id": "5755 and sleep(12)=1", "receiver": "orange@mymail"<br /><br />and sleep(12) - Time based SQL injection.<br />but what is "=1" ?<br />Because a payload usually looks like:<br /><br />and sleep(12)-- <br Anonymoushttps://www.blogger.com/profile/05894498729412154457noreply@blogger.comtag:blogger.com,1999:blog-2987759532072489303.post-85234788385717372016-06-30T11:33:30.846+08:002016-06-30T11:33:30.846+08:00Nice CatchNice CatchAnonymoushttps://www.blogger.com/profile/03945670876691598687noreply@blogger.comtag:blogger.com,1999:blog-2987759532072489303.post-70403179291957825382016-04-07T11:54:23.488+08:002016-04-07T11:54:23.488+08:00Well Done!!! Nice RCE :PWell Done!!! Nice RCE :PAnonymoushttps://www.blogger.com/profile/17944082668804551710noreply@blogger.com