the first example of injection.
Vulnerabilities that we're going to talk about is os command injection.
As the name suggests,
these vulnerabilities allow us to execute system
commands on the target web server.
So as mentioned earlier, a website is simply a computer that is hosted on the cloud.
This computer just like your computer runs an operating system such as Windows,
Linux
or Mac.
Therefore command injection.
Vulnerabilities allow us to execute system commands on that computer.
So if the target computer is Windows, you'll be able to execute when those commands.
If it's Lennox, you'll be able to execute
commands,
answer one.
So for example, if the target web server runs Linux,
which is one of the most common operating systems to run on web servers,
then you'll be able to execute any terminal command
or any Linux command on the target web server.
Therefore, as a result,
you're going to be able to compromise the application
and possibly the whole computer or the whole server.
And in many cases you'll even be able to compromise the whole network
that the target computer or the target web server is connected to.
Because if you've done any of my courses or if you have any Linux
or Windows experience, you'll know that you can do so much using the command line.
But anyway, in most bug bounty scenarios, all you have to do is display impact.
So all you have to do is show them
that you're able to execute a system command on the target
and that's enough to show them that the target is vulnerable and to get your bounty.
So let's have a look on a simple example and
we'll build up on that in the next lectures.
As usual I'm going to include the link in the resources
and I'm just gonna open it in a new tab.
And as you can see a simple shop website
and as usual you should test every single functionality.
But I know the vulnerable feature is in the product details page.
And if you go down as usual you want to check out the normal behavior of the website.
So we have a stock checker in here that allow us to check the stock
in whatever location you select.
So for example if you select paris and click on check stock
It will show you that they have 73 units of this product.
Pretty cool.
Now usually the next step is to turn on our interceptor in the proxy
and send the request to see all of the data that is being sent,
analyze it and see if we can modify user
data to manipulate the execution of this application.
Now if we click on the inspector in here we can see that
we have two body parameters that we can modify as users and manipulate.
And they are the product I. D. And the store I. D.
So you can double click any of these values and modify them in here.
Or you can close this and modify them in here in plain text.
So as mentioned before.
Everything that comes after the equal sign should be tested for all of
the vulnerabilities that you learned and that you will learn in the future.
So this will take a lot of tests and a lot of trial and error.
Therefore instead of having to click the check stalk and
intercept it in here every time and then modifying it
to make the process easier,
we're going to right click this and send it to the repeater.
I explained what the repeater is and what it does previously.
So I'm not going to explain it again.
But basically as mentioned before it allows us to modify the requests in here,
click on send and see the response and the result in here so that we
can easily modify requests and test for vulnerabilities
and see the response that we get.
But before doing that again as usual we want to
send the normal request and see the normal results.
So this is a normal unmodified request.
And as you can see once we send a violet product I. D. And a violet store I. D.
We get the amount of stock available in that store for the selected product.
So as usual you want to manipulate the values after the equal
sign and test for all of the vulnerabilities that you know.
So the first one we have is the product I. D. Equals three.
And now because we're testing for command injection vulnerabilities
and because I already know that this is vulnerable.
I'm not gonna waste your time tasting for stuff that doesn't exist.
So the first parameter that we're gonna test is the
product ID parameter in here and its value is three.
So we're going to simply send a normal system command.
An example of this would be the U.
Name command which gives you the operating system that
is running on the target computer if it was Linux
or UNIX based.
And to do that,
I'm going to put a semicolon followed by that command which is your name.
Now the reason why I put the semicolon in here because semicolons
can be used in the terminal to contaminate commands or join commands.
So there's a number of special characters and
we'll talk about that more in the next lecture
that can be used in the terminal in order
to execute multiple commands in the same line.
Let me show you a quick example.
So I have my terminal in here and I can basically do
your name to show the version of my kernel which is Darwin
and I can do PWd to show my current working directory which is users zoos
and I can combine both of these commands so I can do you name
semicolon P W D.
And because I use the semicolon in here between the two commands.
It's going to execute the first command,
show me the result and then execute the second command and show me its result.
So let me show you in here.
And as you can see we get the results of executing the two commands.
So what we're doing in here,
we're saying if the target application is executing a system command,
we wanna add a semicolon to inject the second command that we want to run.
And in this case it's the U. Name command.
So we're going to hit send to send it to the target.
And as you can see we get nothing.
So we don't even get the stock value but we
also don't get the result of executing our command.
Therefore we're going to move on to the next parameter
that we have which is the store I D parameter.
And similarly we're still saying coma,
you name the command that we want to execute and we're going to hit sand
and perfect this time. As you can see we're getting the stock amount
plus the result of the execution of our command. So now the result is saying
because the target web server is running a Linux operating system.
So to verify this also, you could do P W D for example to get your working directory
and as you can see we're getting our current working directory.
So from here onwards you can replace this with any system
command that you want to execute on the target system.
And this could be very devastating.
And I show this in my website hacking course because you
can basically gain full control over the target web server.
You can gain full control over the other applications installed on it and
possibly even compromise the internal network that
the target web server is connected to
in a pen test. You have to do this. It would be very useful to include in your report.
But in most bug bounty programs you actually don't need to do
this because by simply executing any command on the target web server,
you're able to display impact and you're able
to prove the existence of this vulnerability.
So you will be awarded by simply displaying this impact.