skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

python-code-injection

Exploit Python eval(), exec(), and compile() injection vulnerabilities in web applications.

253|37|Updated Feb 22, 2026
Search Tags:#python#web security#rce#exec#eval#code injection
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill python-code-injection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: python-code-injection
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/python-code-injection
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill python-code-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the critical security vulnerability of Python code injection, allowing you to exploit flaws in web applications where user input is evaluated directly by Python's eval(), exec(), or compile() functions.

Core Features & Use Cases

  • Vulnerability Confirmation: Precisely identify and confirm Python code injection flaws, distinguishing them from OS command injection and Server-Side Template Injection (SSTI).
  • Exploitation: Execute arbitrary Python code and escalate to OS command execution through various injection contexts (string interpolation, direct evaluation, etc.).
  • Payload Generation: Provides a comprehensive set of payloads for command execution, reverse shells, and data exfiltration, including techniques for bypassing filters and restricted built-ins.
  • Use Case: A penetration tester discovers that a web application's search functionality passes user input directly to eval(). This Skill enables them to confirm the vulnerability, execute commands like id or whoami, and potentially gain a reverse shell on the target server.

Quick Start

Use the python-code-injection skill to confirm code injection by evaluating the expression '7*7'.

Frequently Asked Questions about python-code-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit Python eval and exec injection vulnerabilities in web applications?▼

Python code injection exploits flaws where user input is passed directly to eval(), exec(), or compile(). You can confirm the vulnerability using arithmetic probes like 7*7, then generate payloads for OS command execution and reverse shells.

What is the difference between Python code injection and server-side template injection?▼

Python code injection targets direct evaluation functions like eval() and exec(), whereas SSTI targets template engines. This Skill helps distinguish between them by identifying the specific injection context and confirming flaws through error-based probes.

How can I bypass character filters when performing Python code injection?▼

When exploiting Python code injection with restricted built-ins or character filters, you can use specialized payloads designed to bypass these limitations, enabling command execution and data exfiltration even in constrained environments.

How do I get a reverse shell through a Python code injection vulnerability?▼

After confirming Python code injection via eval() or exec(), you can escalate to OS command execution and deploy reverse shell payloads provided by the Skill to gain interactive access on the target server.

Can I use this Skill to test web applications that pass user input directly to compile()?▼

Yes, this Skill identifies and exploits injection vulnerabilities across eval(), exec(), and compile() functions, confirming flaws through arithmetic and error-based probes to determine if user input is evaluated directly.

Related Skills

Explore More Software Engineering Skills→
luansilvadbluansilvadb

injection-security-review

Trace untrusted input from sources to sinks to identify injection vulnerabilities.

Community
Advanced
Prohao42Prohao42
120

tunneling-and-pivoting

Establish network tunnels and pivot paths from compromised hosts.

Community
Advanced
yhy0yhy0
518

ssrf

Detect and exploit server-side request forgery vulnerabilities in URL parameters.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

ssti-twig

Exploit Twig/PHP server-side template injection to achieve remote code execution.

Official
Advanced