The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

304

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 304

---

HACK STEPS

■

You can normally use the 

ping

command as a means of triggering a time

delay, by causing the server to ping its loopback interface for a specific

period. There are minor differences between the way Windows and Unix-

based platforms handle command separators and the 

ping

command,

but the following all-purpose test string should induce a 30-second time

delay on either platform if no filtering is in place:

|| ping -i 30 127.0.0.1 ; x || ping -n 30 127.0.0.1 &

To maximize your chances of detecting a command injection flaw if the