https://florencenjeri.com/tags/command-injection/ Recent content in command injection on Florence Njeri Hugo -- gohugo.io en Mon, 06 Jul 2026 00:00:00 +0000 https://florencenjeri.com/posts/abusing-eval-in-agent-calculators/ Mon, 06 Jul 2026 00:00:00 +0000 https://florencenjeri.com/posts/abusing-eval-in-agent-calculators/ The exploit and Result : Command Injection via eval() # Step 1: Reconnaisance On level 5, I knew from the description that the application featured a calculator functionality. I started by probing the system to see if I could force it to leak its system prompt. This attempt was unsuccessful, as the application simply echoed my input back to the output. Next, I wanted to see what acceptable values the system could process and determine how it handled mathematical evaluations. I tried inputs like 4 * 4 and 4 / 0 to see if it would return results. It did, which indicates that the application passes my input directly unsanitized to the underlying calculation function.