Repository navigation
Week 2 Lab 2.3
<form id="logform" method="post">
<div>
Search Term: <input type="text" name="search">
</div>
<div class="full-width"><br>
<button type="submit">Search</button>
</div>
</form>
<?php
if (isset($_POST['search'])) {
$searchterm = $_POST['search'];
echo "<div>";
echo "<h1>Search term: " . $searchterm . "</h1>";
echo "</div>";
`echo "<pre>";`
`passthru("grep " . $searchterm . " /usr/share/wordlists/rockyou.txt");`
`echo "</pre>";`
}
?>
When you run php -S 127.0.0.1:9000 -c grepper.php you should be able to search the "rockyou.txt" wordlist like so:
sd
Command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a host operating system via a vulnerable application. It typically occurs when user input is improperly validated or sanitized, enabling malicious users to insert commands into the system that can perform unauthorized actions.
How It Works:
Imagine a web application that lets users ping a server by entering a hostname. If the application directly passes this input to a system command without validation, like so:
ping <user_input>
An attacker could input something like:
example.com; rm -rf /
If the application doesn't sanitize this input, it would execute both the ping command and the rm -rf / command, which could wipe out critical files on the server.
Why It Matters
Command injection can lead to severe consequences, including data breaches, service disruptions, or even complete system takeovers. It’s a powerful attack vector because it leverages the host's operating system, often bypassing security measures that protect application logic.
Common Targets:
Web Applications: Frequently used in poorly coded web applications that run shell commands based on user input.
APIs: Any API that interacts with the system without proper input validation is a potential target.
Administration Tools: Tools that execute system commands based on user-supplied parameters are particularly vulnerable.
Prevention Tips
Input Validation: Always validate and sanitize user input. Use whitelisting to accept only expected inputs.
Parameterization: Use parameterized commands or prepared statements when interacting with the system or databases.
Limit Privileges: Run applications with the least privileges necessary to minimize the impact of a successful attack.
Regular Security Audits: Conduct periodic reviews and security assessments of your applications to identify potential vulnerabilities.