TLDR Tech / InfoSec
Exfiltration using numeric-only outputs
When code injection vulnerabilities return only valid decimal numbers (no reflection, external traffic, or timing), attackers can exfiltrate alphanumeric data by encoding command outputs as base-36 integers using int(command_output, 36) in Python or base_convert() in PHP, with non-alphanumeric characters stripped via string translation functions. Python's 4,300-digit integer limit allows exfiltration of up to 2,762 alphanumeric characters (over 2KB), while 64-bit systems like JavaScript and PHP are limited to roughly 12 characters per conversion, though PHP's BC Math functions enable chunking and concatenation for larger payloads. Base27 encoding can squeeze one additional character into 64-bit limits by shifting the alphabet left and excluding numeric characters, trading information density for longer output capacity in constrained environments.
Read the full story