Explotation 1

Question 1

Command Injection

Answer 1

• A command injection flaw in a web application takes advantage of the manner in which web applications process user input and pass it to the command line to perform a task.
• The best way to prevent a command injection vulnerability is to program the application to do the work instead of using third party command line programs.

For example, you could write PHP to calculate the SHA1 hash for you; there is no need to use the sha1sum tool on the command line.

• If you can’t do that, then you need to sanitise user input.

Question 2

File Inclusion

Answer 2

• A file inclusion vulnerability comes as a result of including resources on a page (be it PHP, or any other type of file) based on user input, in a way that the included file is executed by the web application.
• There are generally two kinds of file inclusion. The first is local file inclusion - which is the most common type - and the second type is remote file inclusion.
• The best way to avoid being vulnerable to this attack is to avoid dynamically including files based on user input. If you can’t, then your script should have a whitelist of allowed files that can be included.

Question 3

Cross Site Scripting (XSS)

Answer 3

• A cross-site scripting (XSS) attack is a client-side attack. This means that, although the vulnerability is in the site itself, the targets of the attack are the users browsing the site.
• The goal is for the attacker to be able to run some JavaScript code in the browsers of the people visiting the site.
• The vulnerability typically occurs in areas of the site where some kind of user input is reflected back to the page (reflected XDD attack)
• The only way to mitigate an XSS vulnerability is to sanitise user input.

Question 4

Stored XSS

Answer 4

• This is where the XSS attack is stored in the database, such as in a forum post. Anyone who then visits that post will be hit with the attack.
• A stored XSS attack is more serious than a reflected XSS attack, because a reflected XSS attack must be targeted at an individual user by sending them a malicious link, while a stored XSS attack targets anyone who visits the affected page.