Investigating web attacks

To gain initial access to a victim’s environment, the attacker may exploit a web application flaw or vulnerability such as command injection, SQL injection, Cross-Site Scripting (XSS), and path traversal vulnerabilities. We’ll look at all four vulnerabilities in this section.

The command injection vulnerability

Some web applications are designed to take input from users and then process it by invoking a shell to run a program to handle the input. An attacker may take advantage of this process and inject a command in their web request inputs to be executed on a vulnerable application. To do so, attackers usually use the ; character at the end of the normal input to be able to add their own injected command (see Figure 12.1):

Figure 12.1 – Command injection flaw exploitation

To exploit and validate a command injection flaw in a web application, attackers often employ commands designed to redirect traffic...