Code Injection - Python Scanner
Detects Python code injection via exec(), eval(), and pickle.
What is Code Injection - Python?
Python Code Injection occurs when untrusted input is passed to code execution functions like exec(), eval(), or compile(), or when deserializing untrusted data with pickle. This allows attackers to execute arbitrary Python code with the application's full privileges.
Why is This Important?
Python powers many web applications, data pipelines, and automation systems. Code injection can compromise entire infrastructure, access sensitive data, pivot to connected systems, and establish persistent access. The pickle vulnerability is particularly insidious because developers often don't realize deserialization executes code.
How It Works
1. Input Discovery
Maps all user input points including forms, headers, cookies, and API parameters for injection testing.
2. Injection Testing
Executes sophisticated injection payloads designed to bypass filters and WAFs while detecting vulnerabilities.
3. Exploitation Validation
Confirms vulnerabilities through safe exploitation, providing proof-of-concept and impact assessment.
Key Capabilities
Advanced injection detection engine combining signature-based and AI-powered analysis for comprehensive coverage.
- Multi-vector injection testing across all input types
- WAF and filter bypass techniques built-in
- Database-specific payload optimization
- Out-of-band detection for blind vulnerabilities
- Automated proof-of-concept generation
Frequently Asked Questions
What makes pickle particularly dangerous?
Pickle can serialize Python objects including code. When unpickling, Python instantiates objects and calls __reduce__ methods, which can execute arbitrary code. Attackers craft malicious pickled data that executes code upon deserialization—no additional user interaction needed.
How do exec() and eval() differ in risk?
exec() can execute statements (including imports and function definitions), while eval() only evaluates expressions. Both are dangerous with user input. eval() can still call functions, import modules via __import__, and access dangerous builtins.
Can I safely use eval() with restricted builtins?
Restricting builtins is insufficient. Attackers can access them through object introspection: ().__class__.__bases__[0].__subclasses__() to find dangerous classes. There is no safe way to eval() arbitrary user input.
How do I prevent Python code injection?
Never use exec()/eval() with user input, use ast.literal_eval() for evaluating data structures, avoid pickle for untrusted data (use JSON instead), sanitize input for template engines, use restricted execution environments only as defense in depth.
Related Scanners
Ready to secure your application?
Start testing for code injection - python vulnerabilities today.
Get Started Free