The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Injecting into Web Scripting Languages

The core logic of most web applications is written in interpreted scripting lan-

guages like PHP, VBScript, and Perl. In addition to the possibilities for inject-

ing into languages used by other back-end components, a key area of

vulnerability concerns injection into the core application code itself. Exposure

to this type of attack arises from two main sources:

■■

Dynamic execution of code that incorporates user-supplied data.

■■

Dynamic inclusion of code files specified on the basis of user-

supplied data.

We will look at each of these vulnerabilities in turn.