the-web-application-hackers-handbook

Chapter 10 n Attacking Back-End Components 367
HACK STEPS
1. Any item of user-supplied data may be passed to a dynamic execution
function. Some of the items most commonly used in this way are the
names and values of cookie parameters and persistent data stored in user
profiles as the result of previous actions.
2. Try submitting the following values in turn as each targeted parameter:
;echo%20111111
echo%20111111
response.write%20111111
:response.write%20111111
3. Review the application’s responses. If the string 111111 is returned on its
own (is not preceded by the rest of the command string), the application
is likely to be vulnerable to the injection of scripting commands.
4. If the string 111111 is not returned, look for any error messages that indicate
that your input is being dynamically executed and that you may need
to fine-tune your syntax to achieve injection of arbitrary commands.
5. If the application you are attacking uses PHP, you can use the test string
phpinfo(), which, if successful, returns the configuration details of the
PHP environment.
6. If the application appears to be vulnerable, verify this by injecting some
commands that result in time delays, as described previously for OS command
injection. For example:
system(‘ping%20127.0.0.1’)
Preventing OS Command Injection
In general, the best way to prevent OS command injection flaws from arising
is to avoid calling out directly to operating system commands. Virtually any
conceivable task that a web application may need to carry out can be achieved
using built-in APIs that cannot be manipulated to perform commands other
than the one intended.
If it is considered unavoidable to embed user-supplied data into command
strings that are passed to an operating system command interpreter, the application
should enforce rigorous defenses to prevent a vulnerability from arising.
If possible, a whitelist should be used to restrict user input to a specific set of
expected values. Alternatively, the input should be restricted to a very narrow
character set, such as alphanumeric characters only. Input containing any other
data, including any conceivable metacharacter or whitespace, should be rejected.