Sins of Command Injection Flashcards
When does command injection occur?
Command injection problems occur when untrusted data is placed into data that is passed to some sort of compiler or interpreter, where the data might, if it’s formatted in a particular way, be treated as something other than data.
Example Windows Commmands
dir, cd, Ipconfig
Example Linux Commands
Is, cd
What is the most important step to redemption?(Command Injection)
To validate user input
Describe the road to redemption(Command)
1.Check the data to make sure it is okay.
- Take an appropriate action when the data is invalid.
- Run your application using least privilege. It usually isn’t very amusing to run arbitrary commands as “nobody” or guest.
Name the three ways to determine Data Validity
The deny-list, The allow-list and The “quoting” approach
Definition deny-list approach
The deny-list approach Look for matches demonstrating that the data is invalid, and accept everything else as valid
What is the first step to prevent command injection when handling input?
Perform input validation on all input before passing it to a command processor.
Definition for allow-list approach
The allow-list approach Look for the set of valid data, and reject anything else (even if there’s some chance it wasn’t problematic).
Definition for the “quoting” approach
The “quoting” approach Transform data so that there cannot be anything unsafe.
How should you handle a failure in input validation?
Handle the failure securely if an input validation check fails.
What is a useful defense mechanism if your environment supports it?(command)
Use taint defenses if your environment supports it.
What should you never do with unvalidated input?
Do not pass unvalidated input to any command processor, even if the intent is that the input will just be data.
Why should you avoid using a deny-list approach for input validation?
Because you cannot be 100 percent sure you are accounting for all possibilities.
What is the recommended approach for writing input validators?
Consider avoiding regular expressions for input validation; instead, write simple and clear validators by hand.
