Code Injection JavaScript Injection JavaScript Injection Server-side JavaScript code injection through eval() and new Function(): source breakouts, in-band command output, time-based blind oracles, and command-execution primitives. new Function() (1) In-band (2) Time-based (1) exec vs execSync (1)