OWASP - User contributions [en]

Code Injection

2006-07-24T08:41:45Z

Thandermax: /* Examples */

{{Template:Attack}}

{{Template:Stub}}

==Description==

This article should cover attacks based on injecting code into a running application.

==Examples ==

If server side scripting is enabled in some address (such as guestbook , where user can insert data)
then the SSI attack can be done.

Such as :

< !--#exec cmd="ls" -- >

will show all the files in current directory is the server is on a UNIX/LINUX machine.

for Windows platform : < !--#exec cmd="dir"-- >

This can be used for destructive purpose also , as the commands are executed in root/admin previlage.

Such as < !--#exec cmd="format c:"-- >

==Related Threats==

==Related Attacks==

==Related Vulnerabilities==

==Related Countermeasures==

[[Category:Attack]]

[[Category:Injection Attack]]

Code Injection

2006-07-24T08:40:12Z

Thandermax: /* Examples */

{{Template:Attack}}

{{Template:Stub}}

==Description==

This article should cover attacks based on injecting code into a running application.

==Examples ==

If server side scripting is enabled in some address (such as guestbook , where user can insert data)
then the SSI attack can be done.

Such as :



will show all the files in current directory is the server is on a UNIX/LINUX machine.

for Windows platform : 

This can be used for destructive purpose also , as the commands are executed in root/admin previlage.

Such as 

==Related Threats==

==Related Attacks==

==Related Vulnerabilities==

==Related Countermeasures==

[[Category:Attack]]

[[Category:Injection Attack]]

Detect intrusions

2006-07-24T08:30:43Z

Thandermax: /* Categories */

{{Template:Principle}}

{{Template:Stub}}

==Categories==

[[Category:Principle]]

'''Log All user access (IP,Username,Time ,web request etc..).'''

If you do this ,then someday when your application /site is down/hacked you can trace the culprit and check what went wrong.

You may ask , if the user uses an proxy , Though it will help. As "what happened" is logged and the exploit can be fixed more easily.