diff --git a/Insecure Deserialization/Python.md b/Insecure Deserialization/Python.md index 41887f65..98e843e7 100644 --- a/Insecure Deserialization/Python.md +++ b/Insecure Deserialization/Python.md @@ -32,7 +32,7 @@ Python 2.7 documentation clearly states Pickle should never be used with untrust > The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source. ```python -import cPickle +import cPickle, os from base64 import b64encode, b64decode class Evil(object): @@ -47,4 +47,4 @@ print("Your Evil Token : {}").format(evil_token) ## References * [Exploiting misuse of Python's "pickle" - Mar 20, 2011](https://blog.nelhage.com/2011/03/exploiting-pickle/) -* [Python Pickle Injection - Apr 30, 2017](http://xhyumiracle.com/python-pickle-injection/) \ No newline at end of file +* [Python Pickle Injection - Apr 30, 2017](http://xhyumiracle.com/python-pickle-injection/)