📉
Cybersec mit Shahid
  • Linux
    • Linux Basic to Advanced
    • Linux Hardening
      • Labs
        • Linux Hardening Labs - Making the /boot Volume Read-only
    • Linux Fundamentals
    • User Management
    • Linux PrivEsc
    • Package Management
    • Advanced Linux Programming
    • Linux Command Line Tools
    • Search
    • Ports
    • Troubleshooting
      • How to Fix sub-process /usr/bin/dpkg returned an error code (1) in Ubuntu
  • Windows
    • Windows Hardening
    • Windows Command Line Tools
    • System Hardening
    • Windows Server Update Services (WSUS)
    • Windows Commands
    • Harden Windows Hosts
  • ISO 27001
  • NIST
    • NIST SP 800-82
  • Ethical Hacking Stages
    • Cybersecurity Kill Chain
      • Labs
        • Linux Attack and Response Lab
        • Implementing a network policy server
        • Network Vulnerabilities
        • Analyze Malicious Activity in Memory Using Volatility
        • Scanning and Remediating Vulnerabilities with OpenVAS
        • Install and Configure Network Load Balancing
    • OSINT (Open Source Intelligence)
      • Sock Puppets
      • Google Dorking
      • Social Media OSINT
      • OSINT Advanced
    • Web Hacking Fundamentals
      • OWASP Top 10
        • Pickle Rick (Tryhackme)
        • Injection
        • Broken Authentication
    • Red Team and Blue Team
    • Walkthrough: Luanne
      • Archetype
    • MITRE ATT&CK Framework
      • SSH Authorized Keys
  • CompTIA Security+
    • Threats, Attacks and Vulnerabilities
    • Technologies and Tools
    • Architecture and Design
    • Identity and Access Management
      • Labs
    • Risk Management
      • Policies-Personnel
      • Business Impact Analysis
      • Risk Assessments
      • Incident Response
      • Forensics
      • Controls
      • Data Privacy
    • Cryptography and PKI
      • Cryptographic Hardware
  • Tools
    • NMAP
    • netcat
    • Nessus
    • Wireshark
    • Metasploit
    • Burpsuites
    • Splunk
    • PRTG
  • Ransomeware for Financial Gain
    • Spearphishing
      • Untitled
  • HTB
  • Personal Spaces
  • Python
    • Requests: HTTP
    • Python Advanced Topics
    • Python and Networking
    • Python Coverage
  • CySe Python Projects
    • DDOS Tool
    • Zip Cracker
    • Clipboard Copy
    • Keylogger
    • Port Scanner
    • Location Tracker
    • Replicating Virus
    • WiFi Extractor
    • NFC Cracker
  • Docker
    • Installing Docker and Docker Compose on Raspberry Pi
  • Docker Compose
  • Git
  • IoT Security
  • CPP
  • Networking
    • How exactly security key work and how their improvement over an OTP solution?
    • Securing Network Traffic
    • Network Scanning Python
  • Networking and Security Architecture with VMware NSX
  • Important Links
  • Security Certification
  • Notes
  • Group 1
    • Google Cloud Platform
Powered by GitBook
On this page
  • Injection
  • OS Command Injection

Was this helpful?

  1. Ethical Hacking Stages
  2. Web Hacking Fundamentals
  3. OWASP Top 10

Injection

PreviousPickle Rick (Tryhackme)NextBroken Authentication

Last updated 4 years ago

Was this helpful?

Injection

OS Command Injection

Command Injection occurs when server-side code (like PHP) in a web application makes a system call on the hosting machine.

The worst thing they could do would be to spawn a reverse shell to become the user that the web server is running as. A simple ;nc -e /bin/bash is all that's needed and they own your server; some variants of netcat don't support the -e option. You can use a list of reverse shells as an alternative.

Blind command injection occurs when the system command made to the server does not return the response to the user in the HTML document.

Active command injection will return the response to the user. It can be made visible through several HTML elements.

these