Command Injection - Revision history

Tal Mel: There was a mistake in the difference between code and command injection. The original description described code injection twice.

2018-05-31T10:22:25Z

There was a mistake in the difference between code and command injection. The original description described code injection twice.

Jmanico: /* Related Attacks */

2016-08-07T18:11:16Z

‎Related Attacks

Jmanico: /* References */

2016-08-07T18:11:04Z

‎References

DhirajMishra: /* Example 6 */

2016-08-07T16:46:45Z

‎Example 6

Michael Monsivais: Correcting grammar.

2014-08-26T22:43:37Z

Correcting grammar.

Andrew Smith at 15:51, 14 June 2014

2014-06-14T15:51:37Z

José Luis Escobar at 14:19, 4 December 2012

2012-12-04T14:19:14Z

José Luis Escobar at 14:16, 4 December 2012

2012-12-04T14:16:55Z

Wichers: /* Example 1 */

2009-09-03T03:18:56Z

‎Example 1

Wichers at 03:13, 3 September 2009

2009-09-03T03:13:35Z

@@ Line 8: / Line 8: @@
 Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.
-This attack differs from [[Code Injection]], in that code injection allows the attacker to add his own code that is then executed by the application. In [[Code Injection]], the attacker extends the default functionality of the application without the necessity of executing system commands.
+This attack differs from [[Code Injection]], in that code injection allows the attacker to add his own code that is then executed by the application. In Command Injection, the attacker extends the default functionality of the application, which execute system commands, without the necessity of injecting code.
 <!--==Risk Factors==

@@ Line 192: / Line 192: @@
 * [[LDAP injection]]
 * [[Relative Path Traversal]]
 ==Related [[Controls]]==
 * [[:Category:Input Validation]]

← Older revision		Revision as of 18:11, 7 August 2016
Line 212:		Line 212:
	[[Category:Injection]]		[[Category:Injection]]
	[[Category:Attack]]		[[Category:Attack]]
−	~~[[Category:Externally Linked Page]]~~

@@ Line 172: / Line 172: @@
 </pre>
+Sanitizing Input
 <!--==Related [[Threat Agents]]==
 TBD
 -->
 ==Related [[Attacks]]==
 * [[Code Injection]]

@@ Line 8: / Line 8: @@
 Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.
-This attack differs from [[Code Injection]], in that code injection allows the attacker to adds his own code that is then executed by the application. In [[Code Injection]], the attacker extends the default functionality of the application without the necessity of executing system commands.
+This attack differs from [[Code Injection]], in that code injection allows the attacker to add his own code that is then executed by the application. In [[Code Injection]], the attacker extends the default functionality of the application without the necessity of executing system commands.
 <!--==Risk Factors==

@@ Line 6: / Line 6: @@
 ==Description==
-The purpose of the command injection attack is to inject and execute commands specified by the attacker in the vulnerable application. In situation like this, the application, which executes unwanted system commands, is like a pseudo system shell, and the attacker may use it as any authorized system user. However, commands are executed with the same privileges and environment as the application has. Command injection attacks are possible in most cases because of lack of correct input data validation, which can be manipulated by the attacker (forms, cookies, HTTP headers etc.).
+Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.
-There is a variant of the [[Code Injection]] attack. The difference with code injection is that the attacker adds his own code to the existing code. In this way, the attacker extends the  default functionality of the application without the necessity of executing system commands. Injected code is executed with the same privileges and environment as the application has.
+This attack differs from [[Code Injection]], in that code injection allows the attacker to adds his own code that is then executed by the application. In [[Code Injection]], the attacker extends the default functionality of the application without the necessity of executing system commands.
 <!--==Risk Factors==
@@ Line 147: / Line 145: @@
 '''There are many sites that will tell you that Java's Runtime.exec is exactly the same as C's system function. This is not true. Both allow you to invoke a new program/process. However, C's system function passes its arguments to the shell (/bin/sh) to be parsed, whereas Runtime.exec tries to split the string into an array of words, then executes the first word in the array with the rest of the words as parameters. Runtime.exec does NOT try to invoke the shell at any point. The key difference is that much of the functionality provided by the shell that could be used for mischief (chaining commands using "&", "&&", "|", "||", etc, redirecting input and output) would simply end up as a parameter being passed to the first command, and likely causing a syntax error, or being thrown out as an invalid parameter.'''
 <!--==Related [[Threat Agents]]==

← Older revision		Revision as of 14:19, 4 December 2012
Line 178:		Line 178:
	[[Category:Attack]]		[[Category:Attack]]
	[[Category:Externally Linked Page]]		[[Category:Externally Linked Page]]
−
−
−	~~#'''Traduccion en Español: ''' [[Traducción]]~~

← Older revision		Revision as of 14:16, 4 December 2012
Line 178:		Line 178:
	[[Category:Attack]]		[[Category:Attack]]
	[[Category:Externally Linked Page]]		[[Category:Externally Linked Page]]
		+
		+
		+	#'''Traduccion en Español: ''' [[Traducción]]

@@ Line 58: / Line 58: @@
 unstosig.c              www*                    a.out*
 format.c                strlen.c                useFree*
-catWrapper*             misnull.c               strlength.c                useFree.c               commandinjection.c      nodefault.c             trunc.c                 writeWhatWhere.c
+catWrapper*             misnull.c               strlength.c             useFree.c
 If catWrapper had been set to have a higher privilege level than the standard user, arbitrary commands could be executed with that higher privilege.