So let us continue with command execution on that vulnerable Web application.
In the last lecture, we saw how to explode the command execution on Low-Level security, but not every
application has deployed that level of security.
Generally, the applications are not secure or slightly medium security level.
So in this lecture, we will see how to exploit the command execution when the reality on down, when
the level of application, but with a medium security level.
So there are two things start to occur Linux machine login and then also start your demo level with
application.
So let us get started.
So now you can see that I have logged into my account.
You have to go to applications and then go to Firefox.
They're in the other you have to take the IP address of your machine, in my case, the IP address is
ten point two point one point six.
And you can see I have logged into my DV w e with the default username and password.
In this lecture, we're going to explore the combined injection at a medium security, so set the security
level to medium and then go to commercial execution.
Let us see if it is working.
So just typing and the IP address.
So just submit.
And yes, it is working.
Now, let us try to exploit this when the reality with the method that we are seen in the previous lecture.
Let's to see if that works.
We didn't get the last word.
We didn't execute the Alaska command, so which means that this application is secure.
So now what to do, how to execute the command and how to exploit this vulnerability?
Well, that is one way in which you can.
It's about this one little it's just head on to terminal.
And there I will show you how you can exploit the vulnerability, just type less.
And you can see these are the applications after typing the list, come on now, you want to go to seed.
So just just type ellis'.
Alice and space height type bond, so this is a bar and then type city next up.
Before hitting enter now let us guess the result.
I think it will first again show the application.
It is it will force execute the command and then after it will go to the store, let us see what we
get hit.
Enter.
Oh, my God.
We didn't get anything before.
Now let us see or else, so let us check where we are hit BWV.
And then hit enter.
So you are again in the home, that is Karlee, which means that the alleged gunman didn't get executed.
Right.
So whatever comes after the bar, we can execute that command.
Right now, it has got execute executed.
So what if we apply this same trick in that input?
Will let us check.
So the IP address just by the IP address.
So just take the IP address here.
Space bar.
And then take the command BWV.
Let us see if this works.
Vola, we have successfully exploited this one repeatedly, and you can see that the first command,
which was before the bar, did not get executed here there is another command, Ellis.
Again, it got executed, so this was one trick of exploiting come online injection, command execution.
Now, again, there are many websites which asks for input, but, you know, they are more secure now.
That is a command which we have seen in Al-Khalili command to total, which is used to create a file.
So let's see if this gets executed.
And right now, we didn't get any input.
So just enter and let's see, let's command to check the input and we should see our text file created.
There we go.
We have ABC dirtbag's.
So the conclusion of this lecture is whatever you type after the bar command gets executed and the command
that is before the bar gets hidden.
But what, like this?
Now, when you enter that command, that is the IP address, space, bar and space, then the next command,
what does the input validation does it?
It sees the IP address.
It sees space, and that's it.
It thinks that there might be nothing after that space.
So it validates and sends a request to the server.
Now, that is again a problem of server side validation here.
Server is investigating whether there is any other input present after the IP address.
This is a fault of server side validation as well as guarantied validation.
So this is how we exploited the command execution vulnerability at a medium level security.
So you have to follow these principles or these rules when you are trying to check the command execution
of the really valuable testing any application.
Now, again, these commands or these tricks won't work every time we have to research on your own to
find more advanced commands on how to hide commands or how to execute different commands, it is your
job to find everything and read more about advanced commands.
I will see you in the next lecture.