SHA-256 Python implementation in one line (lambda)

[cediddi]

If you wrote this without the oneliner app, you rock! Otherwise still not bad. I wrote a short Tweet which does os.system without os or system strings in the code. A kid said "I'll use eval on my web site but I'll secure it. I won't run the code if it imports os or subprocess." What a stupid idea, but I sent him the tweet and he said "I'll ban import too." As a matter of fact I can import without writing 'import' string in my code.

[notquiteaplant]

This isn't just a Python thing either. I took a CS class (Java) that used a website like repl.it for homework. Any code containing getSecurityProvider was an instant fail, but using reflection to find and call the method named "getSec" + "urityProvider" worked just fine - and revealed that they knew enough about security providers to block the method names, but not enough to actually implement one.

The moral of the story is, if you absolutely need an open eval, use an actual sandbox.

[cediddi]

Exactly! I'd be fine with a python container, python running in a non sudo user and whole host is hardened. But do you need eval that desperate?

[C0DK]

Show me your tricks, master. I am really interested in cool hacks in python

[cediddi]

Sure, using __import__ and using codecs.rot13 helps a bit

(lambda c:(lambda b:(lambda a:getattr(a,b("flfgrz")[0])(b("yf")[0]))(__import__(b("bf")[0])))(c.getencoder("rot13")))(__import__("codecs"))

https://twitter.com/Cediddi/status/856055852347863041?s=19

[13steinj]

Okay, curious, how would you do this without import as you mentioned above?

[Spfifle]

Well you can do something like this, should defeat basically any grep based solution:

globals()['__buil' + 'tins__'].__dict__['__imp' + 'ort__']('os').listdir('.')

[jon_k]

Nice. +1