in this lecture we'll talk about blind or s command injection. Vulnerabilities.
So in the previous lecture we were able to inject a system command in
a request and see the result of the command execution in the response.
So in this case it's very easy to validate the
existence of the bug and even to exploit it because
you can literally see the result right in front of
you as if you're executing the command on the terminal.
Now,
in many cases the target web application might be
vulnerable to an os command execution similar to what we
have in here and you'd be able to exploit it exactly the same way that you see in here.
But the web application is not going to show you the result of the command execution,
hence the name blind or s command injection
and therefore making it harder to discover or spot.
In this case we can execute a command that might cause the target system
to pause or sleep for a few seconds and then monitor the time taken for the response.
Let me show you an example.
So again, I'm going to share the link in the resources of this lecture
and I'm actually gonna turn off my proxy because it's already running
and we have a website that is very similar to the one that we've seen previously
test everything as usual.
But I know where the bug is. It's in the submit feedback in here
and as you can see you have a number of input boxes which you should manipulate.
As we said before to discover all of the vulnerabilities and exploits
that you learned before and that you will learn in the future.
But I'm actually just going to fill this with some dummy values
and you want to put anything in here,
click on sent feedback and analyze the result that you get.
And as you can see it just seems like it's actually submitting your feedback.
But let's do it again.
And this time I'm gonna turn on my interceptor first
and send the request.
And as you can see we have a number of values that can be manipulated by us by the user.
You can edit them in here in plain text or you can edit
them in here in the inspector under the request by the parameters.
But if I edit it now and forward it
I'll have to fill this form again,
click on submit and edit it here again to test for other vulnerabilities.
Therefore as usual I'm going to right click and send it to the repeater so that I
can modify the values in the request and
see the response straight away without wasting any time
similar to what we've been doing so far.
Now as I mentioned everything after an equal sign should be tested.
But I know the vulnerable parameter right now which is the email.
So in a real life scenario you want to test
every single value that you see after the equal.
But I don't want to waste your time.
That's why we're sticking with this one right here
and we're simply going to do what we learned before. So we're gonna put a coma
P. W. D.
And we're going to click on sand
and as you can see we get an empty response. Now we know P. W. D.
Should show us our working directory but we can see that we got nothing.
Now you can test other commands as well in here
but I know this exploit is not gonna work because the web application
is not going to display the result for us in here anyway,
even if the command is being executed on the target system.
So as mentioned this is an example of a blind command execution.
So what we're gonna do is execute a command
that will delay the execution of the application.
An example would be the sleep command.
So let me show you a quick example in your terminal.
You can simply type sleep followed by the amount of
seconds that you want the terminal to sleep for.
And when I hit enter
I won't see the prompt for another five seconds.
As you can see now I got the prompt again.
So if I inject this command in the target application and
if the target application is vulnerable to a command execution,
I don't even need to see the result.
If the target application sleeps for 10 seconds or
five seconds or whatever amount of seconds I specify
then I will know that the target application is executing my commands
and therefore even though we can't see the result of the command,
we know that the target is vulnerable and we can execute other more
dangerous commands that will allow you to gain full control over the server.
And as I mentioned in the previous lecture,
I cover that in the website hacking course that I have.
But this is not really relevant for bug hunting because simply displaying
impact this way is enough for you to get your bounty.
So we're going to delete the P. W. D. And we're gonna type sleep
and I'm actually gonna put a plus instead of
a space because I'm submitting this through a http request
and I'm gonna put the value which is five seconds.
So I'm going to hit send
And right now we're getting an error saying could not save.
We weren't getting an error.
And the status code is 500.
Remember the status codes that we spoke about previously?
500 means the Web server refused to execute the request that we gave it.
But anyway, we got the response too quickly.
So the web application did not sleep for five seconds and therefore we
know that the command that we specified in here did not work.
So there is a bit of trial and error to this and
you can actually use the intruder in here to make this faster.
But we're gonna talk about that later.
So for now we're gonna stick with this and just do it manually
and basically you're just going to have to keep trying different
types of payloads until you can get it to work.
So I'm gonna attach a cheat sheet in here within the resources of this lecture.
And as you can see within this cheat sheet it's going to explain to you
the different characters that you can use in
order to discover and exploit command injection,
vulnerabilities
and it's usually stuff that is used in the terminal
or in the command prompt to combine two commands.
So similar to the comma you could actually use
and and or you could use or or
and the list goes on as you see in here.
But what I wanna do right now I'm actually adding a semicolon in here.
And what I wanna do, I wanna add another semicolon at the end
just in case there is another command to
be executed after the command that I'm injecting.
So we don't know how do web application is programmed and we don't know the code
that is used in there.
Therefore there is a trial and error and therefore
I'm assuming well maybe my command is being executed between
two commands and therefore I have to add a
semi column before it and a semicolon after it.
So I'm going to hit send
and as you can see we don't get a response
and we're probably gonna get it after five seconds.
And as you can see we actually got the response after five seconds.
Now to validate this, you can put an even bigger number so let's put 10 seconds
And sent
and now the response should even take longer
because now we're sleeping for 10 seconds.
And perfect as you can see we actually got the response after 10 seconds.
So this validates that the target web application
is vulnerable to a blind os command execution.
And like I said from here onwards,
if this was a pen test you can actually inject payloads
that will send you a reverse connection to your own computer
and then you'll be able to communicate with the
web server using a normal terminal like this one
and directly and interactively execute commands and get the
result in here and compromise the whole web application,
the whole server and possibly the whole network.
Mhm.
Now just going back in here to the examples that we have
and just to show you that not only semi colons work,
you can actually replace the semi colons with double bars which means I
want to execute whatever command that comes before my command or my command.
So I'm gonna put one at the front and one at the back
I'm gonna send.
And again as you can see the Web application is going to sleep for
10 seconds meaning that it's actually executing
the command that I'm injecting in here.
So you shouldn't simply give up if you type a command and you don't get the result,
you should test for blind and you should also test for all of the possible ways
of injecting an operating system command and you
can use the intruder feature for that.
I will teach you exactly how to use that later on within the course,
so don't worry about that for now,
the goal of this lecture is to simply learn about blind
command, execution vulnerabilities.