Command Injection vulnerabilities are a class of application security issue where an attacker can cause the application to execute an underlying operating system command. For that reason it’s generally a high impact issue. It can be exploited simply by chaining commands along with the expected input by using shell control characters such as:
Developers have a variety of reasons why they might want their web applications to execute underlying operating system commands. One example could be an application that allows a user to check if a host is online by pinging its IP address. The URL for this function could look something like this:
and the output on the screen could be:
- Interactive cross-site scripting (XSS) cheat sheet for 2021, brought to you by PortSwigger. Actively maintained, and regularly updated with new vectors.
- SQL injection A SQL injection attack consists of insertion or “injection” of a SQL query via the input data from the client to the application. Attempting to manipulate SQL queries may have goals including: Information Leakage Disclosure of stored data Manipulation of stored data Bypassing authorisation controls Summary CheatSheet MSSQL Injection CheatSheet MySQL Injection CheatSheet.
- XSS Cheat Sheet – 2020 Edition Disclaimer We, author and publisher, are not responsible for the use of this material or the damage caused by application of the information provided in this book. Introduction This cheat sheet is meant to be used by bug hunters, penetration testers, security analysts, web application security students.
However if user input is insecurely passed to this function a user could chain a command on the end, such as ” && id” and this would be executed along with the main command, changing the input in our example to this:
and so the output on the screen would be:
Below you will find MySQL specific syntax whilst I will post my MSSQL cheat sheet shortly. To avoid repetition, anywhere you see: version (used to to retrieve the.
As you might guess from above, the user gains the permissions that the affected application has, so if it’s running as www-data or root you’d get that privilege level! An easy way to compromise a box and potentially allow an attacker to take over the webserver, deface the application or steal confidential data!
However things get more complicated for the attacker is the system does not show the output in the application itself, it might just silently execute the command and output something generic like “Success” or “done”. If this is the case an attacker can still determine the existance of the vulnerability and blindly exploit it through inference.
For example imaging chaining to the end of the input the linux command “sleep”, such as:
With this request the output, if vulnerable, would come through as expected with the “Success” message, however it would take a noticable about of time to return – something around 10 seconds longer than without the payload. To determine if this was just a laggy server or not you could try multiple different delay levels to see if the received delay matches the expected amount. So sleep 10 causes approximately a 10 second delay and sleep 30 causes approximately a 30 second delay, reducing the likelihood that this is a false positive.
At this point you’ve got a successful Blind Command Injection vulnerability! Before I get on to how to utilise that as an attacker however, there’s one more type to deal with. Blind injection with out-of-band detection. This class occurs is a vulnerability is vulnerable but no change in output can be perceived through the application, for example if the application executes the request in a new thread, so delaying the server through the “sleep” command doesn’t work (or at least can’t be perceived through the application itself).
In this case we can get our “noticable change” by calling out to another server and monitoring that server for requests. For example you could try a payload like the following:
This would cause an affected (Linux) server to call out to the attacker’s machine. The wget command online requests the server download a web page. Therefore the attacker could see that the payload worked successfully as their logs would show a GET request to the file: /?attacksuccessful
Now to turn that into a viable attack payload to, for example, steal confidential files the attacker could try chaining the contents of the file in the request to the attackers server! A payload like this would be effective:
Here the attacker is taking the contents of the confidential file /etc/password, encoding it with base64 so that it’s possible to transmit it in a URL and then using the wget command again to send that file in a HTTP GET request to the atttacker controlled server! One thing to remember is that the base64 command will line wrap by default after 76 characters, but you can use -w 0 parameter to disable this, like this:
As you can imagine, this is a pretty bad vulnerability which I’ve seen multiple times during Penetration Testing engagements but I’ve seen little in the way of content online about the issue, so I thought I’d throw a few notes down in a post. The important part though: there are specific ways to secure command execution depending on your underlying language and programming framework however one thing that’ll work for general cases is effective user input filtering! Luckily, I’ve written about that here!
Again, the minimum characters to consider dangerous in regards to this issue are:
Payloads can be incredibly varied as the attacker has an awful lot of flexibility, but a few simple ones are things like:
Cheat Sheets
Reverse Shell Cheat Sheet
If you’re lucky enough to find a command execution vulnerability during a penetration test, pretty soon afterwards you’ll probably want an interactive shell. If it’s not possible to add a new account / SSH key / .rhosts file and just log in, your next step is likely to be either trowing back a reverse shell or binding [..]
Tags: bash, cheatsheet, netcat, pentest, perl, php, python, reverseshell, ruby, xterm
Posted in: Shells
SSH Cheat Sheet
SSH has several features that are useful during pentesting and auditing. This page aims to remind us of the syntax for the most useful features. NB: This page does not attempt to replace the man page for pentesters, only to supplement it with some pertinent examples. SOCKS Proxy Set up a SOCKS proxy on 127.0.0.1:1080 that lets [..]
Tags: pentest, ssh
Url Injection Cheat Sheet Pentestmonkey
Posted in: Cheat Sheets
John The Ripper Hash Formats
John the Ripper is a favourite password cracking tool of many pentesters. There is plenty of documentation about its command line options. I’ve encountered the following problems using John the Ripper. These are not problems with the tool itself, but inherent problems with pentesting and password cracking in general. Sometimes I stumble across hashes on a [..]
Tags: johntheripper, pentest Jettison mac utility.
Posted in: Cheat Sheets Ahnlab v3 internet security 9 0 full download.
Informix SQL Injection Cheat Sheet
Some useful syntax reminders for SQL Injection into Informix databases…
Tags: cheatsheet, database, informix
Posted in: SQL Injection
MSSQL Injection Cheat Sheet
Some useful syntax reminders for SQL Injection into MSSQL databases…
Tags: cheatsheet, mssql, sqlinjection Naruto full episodes english season 1.
Posted in: SQL Injection
Oracle SQL Injection Cheat Sheet
Some useful syntax reminders for SQL Injection into Oracle databases…
Tags: cheatsheet, database, oracle, pentest, sqlinjection
Posted in: SQL Injection
MySQL SQL Injection Cheat Sheet
Some useful syntax reminders for SQL Injection into MySQL databases…
Tags: cheatsheet, database, mysql, pentest, sqlinjection
Oracle Sql Injection Cheat Sheet
Posted in: SQL Injection
Postgres SQL Injection Cheat Sheet
Some useful syntax reminders for SQL Injection into PostgreSQL databases…
Tags: cheatsheet, database, pentest, postgresql, sqlinjection
Posted in: SQL Injection
DB2 SQL Injection Cheat Sheet
Finding a SQL injection vulnerability in a web application backed by DB2 isn’t too common in my experience. When you do find one, though it pays to be prepared…
Tags: cheatsheet, database, db2, pentest, sqlinjection
Posted in: SQL Injection
Ingres SQL Injection Cheat Sheet
Ingres seems to be one of the less common database backends for web applications, so I thought it would be worth installing it and making some notes to make my next Ingres-based web app test a little easier.
Tags: cheatsheet, database, ingres, pentest, sqlinjection
Posted in: SQL Injection