The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Dynamic Execution Vulnerabilities

Many web scripting languages support the dynamic execution of code that is

generated at runtime. This feature enables developers to create applications

that dynamically modify their own code in response to various data and con-

ditions. If user input is incorporated into code that is dynamically executed,

Chapter 9 

■

Injecting Code

307

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 307

---

then an attacker may be able to supply crafted input that breaks out of the

intended data context and specifies commands that are executed on the server

in the same way as if they had been written by the original developer. Because

most scripting languages contain powerful APIs that may be used to access the

underlying operating system, code injection into the web application often

leads to a compromise of the entire server.