The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 9 

■

Injecting Code

301

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 301

---

Figure 9-4: A successful command injection attack

Here, the output from the original 

du

command has been redirected as the

input to the command 

cat /etc/passwd

. This command simply ignores the

input and performs its sole task of outputting the contents of the 

passwd

file.

An attack as simple as this may appear improbable; however, exactly this

type of command injection has been found in numerous commercial products.

For example, HP Openview was found to be vulnerable to a command injec-

tion flaw within the following URL:

https://target:3443/OvCgi/connectedNodes.ovpl?node=a| [your command] |