DVWA COMMAND INJECTION

  • It's a RCE(Remote Code Execution) where user input concatenated into system commands.
  • Attacks can execute codes on your machine.
  • On the O.S system input strings can be executed as the input command.
  • Reverse Shell= Target machines communicate to attacking machine.

. It may differ between the OS like linux and windows.

LAB SETUP

  • KALI LINUX
  • DVWA

Open DVWA the Kali Terminal.

go ahead and Input the level to low,medium,high& Impossible.

1. Low level

  • Input ; the address 127.0.0.1 to ping
None
  • Output
None

a. Payloads

I injected different payloads using the semicolon to show additional instructions.

2. Medium level

The application filters certain characters.

  • 127.0.0.1; whoami
None

- 127.0.0.1; pwd

None
  • 127.0.0.1; cat/etc/passwd
None
  • 127.0.0.1; ifconfig
None
None

4. Impossible

None

- This is a failed Injection

  • Only a valid input was processed.

THATS ITT FOR COMMAND INJECTION!!! THANK YOU!!