The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Continued

Chapter 9 

■

Injecting Code

305

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 305

---

306

Chapter 9 

■

Injecting Code

HACK STEPS (continued)

■

Once you have found a means of injecting commands and retrieving the

results, you should determine your privilege level (by using 

whoami

or

something similar, or attempting to write a harmless file to a protected

directory). You may then seek to escalate privileges, gain backdoor

access to sensitive application data, or attack other hosts reachable from

the compromised server. 

In some cases, it may not be possible to inject an entirely separate command,

due to filtering of required characters, or the behavior of the command API

being used by the application. Nevertheless, it may still be possible to interfere

with the behavior of the command being performed, to achieve some desired

result.