OffensiveWeb
Docs
  • Getting started
    • Introduction
    • Learning
    • Vulnerability / CTF reports
    • Cheatsheets
  • Client-side
    • Service Worker
    • DOM Clobbering
    • HTML Tags
    • Window object
    • XSS - Cross-site Scripting
    • Browser Cache
    • CSP Bypass
    • JSONP
    • Same Origin Method Execution
    • XSLeaks
  • Framework
    • Apache
    • DOMPurify
    • Drupal
    • Express.js
    • HTMX
    • Nginx
    • Node.js
    • Nuxt
    • Spring Boot
    • VueJS
    • Werkzeug
    • Wordpress
  • HTTP
    • Content-Type
    • Cookie
    • Cross-Origin Read Blocking (CORB)
    • Cross-Origin Resource Policy (CORP)
    • Cross-Origin Resource Sharing (CORS)
    • X-Content-Type-Options (XCTO)
  • Others
    • Browser exploit
    • Burpsuite
    • Debugging
    • Open Redirect
    • Parsing
    • Prototype Pollution
  • Programming
    • Ruby
    • Javascript
      • Javascript
      • Strange behavior
    • PHP
    • Python
      • Python
      • Class Pollution
      • Format String
  • Server-side
    • GraphQL
    • Server-Side Caching
    • SQL Injection
    • SSRF - Server-side Request Forgery
    • SSTI
      • Django Template
      • EJS
      • Pug
      • Tera
  • WriteUp
    • SEKAI CTF 2023 - Golf Jail
OffensiveWeb
  • Getting started
  • Client-side
  • Server-side
  • Framework
  • HTTP
  • Twitter
  • GitHub
Get started
Get started

Search

Loading search index…

No recent searches

No results for "Query here"

  • to select
  • to navigate
  • to close

Search by FlexSearch

  • Getting started
    • Introduction
    • Learning
    • Vulnerability / CTF reports
    • Cheatsheets
  • Client-side
    • Service Worker
    • DOM Clobbering
    • HTML Tags
    • Window object
    • XSS - Cross-site Scripting
    • Browser Cache
    • CSP Bypass
    • JSONP
    • Same Origin Method Execution
    • XSLeaks
  • Framework
    • Apache
    • DOMPurify
    • Drupal
    • Express.js
    • HTMX
    • Nginx
    • Node.js
    • Nuxt
    • Spring Boot
    • VueJS
    • Werkzeug
    • Wordpress
  • HTTP
    • Content-Type
    • Cookie
    • Cross-Origin Read Blocking (CORB)
    • Cross-Origin Resource Policy (CORP)
    • Cross-Origin Resource Sharing (CORS)
    • X-Content-Type-Options (XCTO)
  • Others
    • Browser exploit
    • Burpsuite
    • Debugging
    • Open Redirect
    • Parsing
    • Prototype Pollution
  • Programming
    • Ruby
    • Javascript
      • Javascript
      • Strange behavior
    • PHP
    • Python
      • Python
      • Class Pollution
      • Format String
  • Server-side
    • GraphQL
    • Server-Side Caching
    • SQL Injection
    • SSRF - Server-side Request Forgery
    • SSTI
      • Django Template
      • EJS
      • Pug
      • Tera
  • WriteUp
    • SEKAI CTF 2023 - Golf Jail

On this page

  • Python
  • Modules
    • os.path
    • re

Python

On this page
  • Python
  • Modules
    • os.path
    • re

Python#

Python is a high-level, interpreted programming language known for its simplicity and readability.

Modules#

os.path#

os.path.join("uploads/", "flag.txt")  # uploads/flag.txt
os.path.join("uploads/", "/flag.txt") # /flag.txt
os.path.join("uploads/", "flag.txt")  # uploads/../flag.txt

re#

>>> re.match("\.", "../")
<re.Match object; span=(0, 1), match='.'>
>>> re.match("\.", "/../") # no match!

Testing Python regex:

  • Regex Tester Online
  • Visual Regex Tester Online
Prev
Cheatsheets
Next
Service Worker
    • Brought to you by Hyas