Hack Security Pro.pdf - Index of

system("/usr/bin/sendmail -t test@test.com ; cat /etc/password);
and the consequence would be the display of the passwd file.
The URL to be used would therefore be of the type:
http://www.xxx.zzz/cgi-bin/test.cgi?variable1=test@test.com;cat%20/etc/passwd
We can also use the example above to modify the value of the variable
par
Naturally, there can be filters whose aim it is to prevent using this character, but they can be easily
bypassed, by using the && character, whose role it is to have the next command executed if the one
that precedes it has been executed without any problem, or by surrounding the character with two |
characters, so that ; will become |;| , which in some cases will prevent its filtering by CGI.
File opening functions such as fopen() or open() can also be serious security threats. On UNIX, it is
possible to pipe (that is, to send to be processed) the result of a function to another function: for this
the | character is used between functions. As it is possible to open a precise file in PERL with the open
() function, it is of course impossible to read it, however it is possible to pipe its result to a function that
will then be executed in an independent process. Let us take the example of the infosrch.cgi, which is
vulnerable to this method: the fname variable, which is used to open a file, can receive as an
argument any function preceded with a pipe. So we will attempt to read the contents of our /
etc/passwd file with the help of the /bin/cat command:
The Hackademy DMP -119/209- SYSDREAM