Hacker News Reader

> Within the tests/evalExploit directory, there is a php file that runs eval() on user input, a common code-injection vulnerability, to experience the power of Polyscripting.

What happens if you eval "`rm -rf /*`;" or "`grep root /etc/passwd`;"? Does it scramble backticks?

View on HN

I doubt it scrambles backticks. In its example on the webpage it just creates a keywork scrambler. The grammar is intact with most of the lexing.

It claims to modify the AST, so yes, hypothetically, it would scramble backticks.

Note that I have not reviewed the code -- I'm only going by the claims in the article.

Reply on news.ycombinator.com