NodeJS

• In forms you can test for code injection similarly to SSTI.

• Enter in mathematical formula to see if it works (see Dibble from PGP)

• If it accepts code, try execution like reverse shell from pentestmonkey.