So why everyone in this lecture, what we're going to cover, we are going to learn about injections
or discom injection, so as we all know of applications that are dynamic in nature, music scripts to
invoke some functionality in the command line on the Web server to process the input received from the
user end.
And an attacker would try to get its input processed at the command line by circumventing the input
validation filters implemented by the application cycle index and usually involves the commands on the
same web server.
And but it is possible that the command would be executed on a different server depending on the architecture
of the application.
So now let's see what are the parameters, what are the parameters where you can inject the data.
So when you are testing of application for communication flow and you have identified that the application
is interacting with the command line of the underlying operating system.
So the next steps should be to manipulate and block the different parameters in the application and
view their responses.
So now, as you can see, they are following parameters should be tested for the communication flow.
So the application may be using one of these parameter to command the server end or get the first you
A listers get.
So in this method, input parameters are sent in UOL and as you can see that the input from the client
was passed to the server, get the matter using the method and was unable to the command decision flow
and any user control parameters send using that method request should be tested.
Then we are having both Porthmadog.
So the post method input parameters are sent in the study as to the body, which is similar to the input
being passed using the and data taken from the end user can also pass using the post method in the body
of the HTP request.
OK then we are having ATP header, so application often use header field to identify end user and display
customised information to the user depending on the values in the header.
So these parameters could also be used by application to build further queries.
OK, so these are the parameters where you can inject the data for finding the communication flow.