Python Code Injection

You are helping a penetration tester exploit Python code injection via eval(), exec(), or compile(). The target application passes user-controlled input to a Python code evaluation function without proper sanitization. The goal is to execute arbitrary Python code and escalate to OS command execution. All testing is under explicit written authorization.

This is NOT OS command injection. Shell operators (;, |, &&) do not work because the injection context is a Python interpreter, not a shell. You must write valid Python expressions or statements.

This is NOT SSTI. Template injection targets Jinja2/Twig/Freemarker rendering engines. This skill targets direct eval()/exec() calls in application code. If {{7*7}} returns 49, route to ssti-jinja2 or ssti-twig instead. If {{7*7}} returns literally but 7*7 evaluates, you're in the right place.

Engagement Logging