Cyber Apocalypse Day #3 | Escaping filters and stealing flags by @WJ Pearce

The main goal of the Cyber Apocalypse 2025 stream is to teach ethical hackers how to exploit Python's eval function to bypass input filters and retrieve flags in CTF challenges 2:15.

Key Takeaways:
• The challenge involves escaping a Python-based filter by exploiting eval to read a flag file, despite blacklisted commands like os or import 4:48.
• A successful attack uses open() and read() to extract the flag, bypassing restrictions by leveraging allowed functions 16:48.
• A real-world red teaming approach uses a payload script to automate command execution over a remote connection, mirroring actual penetration testing scenarios 18:40.
• The stream emphasizes input validation and trusted inputs, warning against using untrusted user input with eval 19:43.

The event concludes with a daily drawing for prizes, and participants are encouraged to join the Discord for further support 3:55.

Sources:

• 2:15 Overview of the talk and its focus on escaping filters using Python.
• 4:48 Discussion of blacklisted functions and how allowed functions like open() and read() are used.
• 16:48 Demonstration of retrieving the flag via file operations in Python.
• 18:40 Real-world red teaming approach using automated payloads.
• 19:43 Key security lesson on input validation and trusted functions.
• 3:55 I