The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

HACK STEPS

■

The 

<

and 

>

characters are used respectively to direct the contents of a

file to the command’s input and to direct the command’s output to a file.

If it is not possible to use the preceding techniques to inject an entirely

separate command, you may still be able to read and write arbitrary file

contents using the 

<

and 

>

characters.

■

Many operating system commands which applications invoke accept a

number of command-line parameters that control their behavior. Often,

user-supplied input is passed to the command as one of these parame-

ters, and you may be able to add further parameters simply by inserting a

space followed by the relevant parameter. For example, a web authoring