Elvis Wiki - User contributions [en]

Code Injection

2024-12-17T11:10:25Z

MReiterer: Created page with "As the number of web applications grows, so does the threat landscape associated with them. Cybersecurity risks, especially those stemming from code injection vulnerabilities, have emerged as some of the most critical challenges for developers. These threats target the core integrity, availability, and confidentiality of data within applications, posing serious risks to individuals, businesses, and governments alike. This article delves into the concept of code injection..."

As the number of web applications grows, so does the threat landscape associated with them. Cybersecurity risks, especially those stemming from code injection vulnerabilities, have emerged as some of the most critical challenges for developers. These threats target the core integrity, availability, and confidentiality of data within applications, posing serious risks to individuals, businesses, and governments alike. This article delves into the concept of code injection, explores its various forms for countermeasures.

== What is Code Injection? ==

The increasing prevalence of web applications and the sensitive user data stored in them increases the threat of attacks such as code injection. This type of attack, which ranked 1st in 2017 and 3rd in 2021 in the OWASP Top 10 Security Risks, has a significant security impact. Attacks occur through vulnerabilities where insufficiently validated user input can manipulate the code of an application. Attackers can bypass security mechanisms, access confidential data or compromise system integrity.
Code injection comprises various attack techniques, including SQL injection, cross-site scripting (XSS) and remote code execution (RCE). These use insufficiently checked user input to execute malicious code in an application. The consequences range from data loss to the impairment of system availability and can cause considerable legal and financial damage.
A typical example is the manipulation of PHP functions that process insecure input via GET parameters, allowing attackers to inject foreign code. Protective measures such as robust input validation are crucial to counteract such attacks and ensure system integrity.

== Types ==

=== Cross-site scripting (XSS) ===

Cross-site Scripting is one of the most prevalent forms of code injection, targeting the interaction between users and web applications. In an XSS attack, malicious scripts (typically JavaScript) are injected into trusted websites. These scripts execute in the victim’s browser, allowing attackers to steal session tokens, cookies, or sensitive information.

* Reflected XSS: Malicious input is included in a request and reflected back to the user. It often exploits dynamic webpage generation and is commonly delivered via URLs in phishing emails.
* Stored XSS: The malicious payload is stored on the target server (e.g., in databases or logs) and served to multiple users, increasing its impact.
* DOM-based XSS: The payload manipulates the browser’s Document Object Model (DOM) to inject and execute scripts, bypassing server-side defenses.

Countermeasure: Employ robust output encoding and avoid unsafe DOM methods like innerHTML.

For more detailed information: https://wiki.elvis.science/index.php?title=Cross-Site_Scripting_(XSS)

=== SQL Injection ===

SQL injection targets an application’s database layer. By inserting malicious SQL statements into input fields, attackers can manipulate database queries, retrieve sensitive data, or even gain administrative control.

Common Techniques:

* Tautology-based Attacks: Manipulating WHERE clauses to always return true.

* Union-based Attacks: Combining legitimate queries with malicious payloads using the UNION operator.

* Error-based Attacks: Exploiting error messages to glean insights about database schema.

* Blind SQL Injection: Using trial-and-error techniques, such as timing responses, to extract information without visible error messages.

Example for SQL injection:

Attack code
name'; DELETE FROM items;--

This input leads to two SQL queries
SELECT * FROM items WHERE owner = 'wiley' AND itemname = 'name';
DELETE FROM items;

The '--' at the end of the statement is interpreted as a comment marker by most database servers. This query was used to return all data records from the “items” table that have that have “owner” equal to “wiley” are returned. Then all records in the “items” table are deleted and in most cases the number of deleted data records are returned. Many database servers allow the execution of several of several SQL statements that are separated by a simicolon. One example is the Microsoft SQL Server. This function is exploited by attackers to execute arbitrary SQL. Oracle can be cited as a positive example, which a restriction on batch executions, as a result of which such an SQL statement would not be successful.

Countermeasures:
* Use prepared statements with parameterized queries.
* Implement strict input validation and sanitization.
* Minimize database user privileges.
* Regularly test applications with SQL injection tools.

For more detailed information: https://wiki.elvis.science/index.php?title=SQL_Injection

=== Remote Code Execution (RCE) ===

Remote Code Execution (RCE) is a particularly dangerous form of code injection in which an attacker is able to execute arbitrary code on the server. RCE attacks differ from other injections in that they not only affect the client, but also manipulate the server side. RCE attackers exploit vulnerabilities in the processing of user input to cause the server to execute malicious code that allows the attacker to control the system. An example of an RCE attack is an attack on the OpenVPN service in 2024, where attackers were able to inject a malicious plugin into the OpenVPN service to execute privileged commands. The attack could only be carried out with existing access to the system, as administrator rights were required. To prevent such attacks, all user input should be strictly validated and input checks performed to prevent the introduction of malicious software.

Countermeasure: Regularly update software and isolate critical server components.

=== Server Side Include (SSI) ===

Server Side Include (SSI) Injection is another form of code injection in which attackers attempt to inject malicious server commands via SSI mechanisms. SSI instructions allow the web server to execute certain scripts or functions before the website is delivered to the user. If this function is not properly secured, an attacker can gain control of the server by injecting malicious SSI instructions into input fields. A successful SSI attack can result in the attacker being able to access sensitive data or even control the entire server environment. These attacks can be detected by using file extensions such as .stm, .shtm or .shtml, which indicate SSI, and by testing SSI commands in the page source code. Examples for SSI:

[[File:Server_Side_Include_1.png|Commmands Server Side Include]]

Countermeasure: Disable SSI processing if unnecessary. For essential use cases, apply strict input validation and limit directive permissions.

== References ==

* https://cwe.mitre.org/data/definitions/94.html
* https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
* https://cwe.mitre.org/data/definitions/79.html
* https://cwe.mitre.org/data/definitions/89.html
* https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
* https://owasp.org/www-community/attacks/Code_Injection
* https://owasp.org/Top10/
* https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/
* Muhammad Zulkhairi Zakaria and Rashidah Kadir. Risk assessment of webapplication penetration testing on cross-site request forgery (csrf) attacks and server-side includes (ssi) injections. In 2021 International Conference on Data Science and Its Applications (ICoDSA), pages 85–90, 2021.
* Mahmoud Mohammadi, Bill Chu, and Heather Richter Lipford. Detecting cross-site scripting vulnerabilities through automated unit testing. In 2017 IEEE International Conference on Software Quality, Reliability and Security (QRS), pages 364–373, 2017

[[Category:Documentation]]

File:Server Side Include 1.png

2024-12-17T10:56:04Z

MReiterer: MReiterer uploaded a new version of File:Server Side Include 1.png

File:Server Side Include 1.png

2024-12-17T10:52:18Z

MReiterer:

HackThisSite

2024-12-17T10:33:17Z

MReiterer: Created page with "HackThisSite is a free training platform to test and develop hacking skills. The philosophy of this site is that all people should have free access to information and hacking should not be a skill mastered by a minority. The core of this website are the challenges. These are divided into different difficulty levels and approaches. In order to complete the missions/challenges, a user must be created. On the website you will find different areas: * Basic Missions: Beginner..."

HackThisSite is a free training platform to test and develop hacking skills. The philosophy of this site is that all people should have free access to information and hacking should not be a skill mastered by a minority. The core of this website are the challenges. These are divided into different difficulty levels and approaches. In order to complete the missions/challenges, a user must be created.
On the website you will find different areas:
* Basic Missions: Beginner missions that cover basic vulnerabilities such as password search and server side include.
* Realistic Missions: Scenarios that simulate real-world web applications and offer more complex challenges.
* Application Challenges: Missions that focus on vulnerabilities in programs and scripts.
* Programming Missions: Exercises for the development of secure program codes.
* Community: A forum and chat areas to share experiences and get tips.

To show how the website works, two basic and one realistic mission are presented below. It is explained step by step how to approach this task and how it is solved.

== Example Basic Mission ==

All tasks in Basic have the requirement that you have to find a password. There is always a task text to help you solve the challenge.

=== Basic 7 ===
After entering a year, this task displays a calendar divided into months. These are structured according to calendar weeks.

[[File:HackThisSite_B7_1.png|Basic Mission 7 Picture 1]]

[[File:HackThisSite_B7_2.png|Basic Mission 7 Picture 2]]

The web server is UNIX-based, as the information has told us. This means that the known commands are available to us if the web server is not secured accordingly. If we now enter a year and ";ls" in the input field, we get the following result:

[[File:HackThisSite_B7_3.png|Basic Mission 7 Picture 3]]

The server now executes the actual function for generating the calendar and then the transmitted “ls” command. We can now see which files are present in the directory. The file “k1kh31b1n55h.php” contains the password for solving this challenge. Now all you have to do is enter the password in the input field and the task is solved.

=== Basic 9 ===
In this example, the password is to be entered again. There is no input field available for a command. However, you can use the input fields from other challenges to get the password for basic task 9.

[[File:HackThisSite_B9_1.png|Basic Mission 9 Picture 1]]

In mission 8, the two commands listed below can be entered to open the files for mission 9 in a new tab. Now you only need to enter the password in the input field and this task is complete.

[[File:HackThisSite_B9_3.png|Basic Mission 9 Picture 2]]

[[File:HackThisSite_B9_2.png|Basic Mission 9 Picture 3]]

== Example Realistic Mission ==
In the realistic missions there are different levels of difficulty (easy to very difficult). For each task there is a description of what needs to be done. When you start the mission, a new tab opens with the page.

=== Realistic 11 ===
In this more realistic challenge, a backup of the actual community (space46) is to be created for the website taken over by a hacker. This example can be solved with a type of code injection.

By changing the URL to https://www.hackthissite.org/missions/realistic/11/page.pl?page=|ls| and the website is not secured against the injection, we get all the files in the folder:

[[File:HackThisSite_R11_1.png|Realistic Mission 11 Picture 1]]

Now we can add the URL with the listed files to view them. If we use “client_http_docs” we get to an index page.

[[File:HackThisSite_R11_2.png|Realistic Mission 11 Picture 2]]

In the “therightwayradio” folder, we are taken to another index page that allows user input. In the posted comment there is a poster whose profile data can be viewed.

[[File:HackThisSite_R11_3.png|Realistic Mission 11 Picture 3]]

The current URL refers to the user accounts with IDs. By exchanging the IDs, you can access the profile of “aclu_bomber_08290” via https://www.hackthissite.org/missions/realistic/11/client_http_docs/therightwayradio/?page=userinfo&id=0.

[[File:HackThisSite_R11_4.png|Realistic Mission 11 Picture 4]]

On this page there is an edit button and an option to change the password (e.g. to aclu_bomber_08290). Now we can log in as “aclu_bomber_08290” on this page. As a logged-in user, we have several functions at our disposal. Among other things, a “mod” that takes us to a page with a possible SQL input field.

[[File:HackThisSite_R11_5.png|Realistic Mission 11 Picture 5]]

With the SQL statements we get the user list:
SELECT name FROM sqlite_master WHERE type='table';
SELECT * FROM web_hosting;
Users that are listed among others:
* space46/notofthisworld
* wonderdiet/suckereveryminute

Now we try to enter the user data at https://www.hackthissite.org/missions/realistic/11/admin/. With “wonderdiet” we get to the administration page.

[[File:HackThisSite_R11_6.png|Realistic Mission 11 Picture 6]]

With the menu item “download” we can display the page content. If we now change the URL called up so that we can access the user “space46” with the source file, we get the desired backup for the community.
https://www.hackthissite.org/missions/realistic/11/admin/d.pl?file=/var/www/budgetserv/html/client_http_docs/space46/src.tar.gz

After entering the URL, the website is closed and the task is completed.

== Alternatives ==

* https://wiki.elvis.science/index.php?title=Defend_The_Web

== References ==

* https://www.hackthissite.org/
Note: Unfortunately, HackThisSite was no longer available at the time the article was published.

[[Category:Documentation]]

File:HackThisSite R11 6.png

2024-12-17T10:01:18Z

MReiterer:

File:HackThisSite R11 5.png

2024-12-17T10:01:12Z

MReiterer:

File:HackThisSite R11 4.png

2024-12-17T10:01:04Z

MReiterer:

File:HackThisSite R11 3.png

2024-12-17T10:00:59Z

MReiterer:

File:HackThisSite R11 2.png

2024-12-17T10:00:52Z

MReiterer:

File:HackThisSite R11 1.png

2024-12-17T10:00:43Z

MReiterer:

File:HackThisSite B9 3.png

2024-12-17T09:49:40Z

MReiterer:

File:HackThisSite B9 2.png

2024-12-17T09:49:33Z

MReiterer:

File:HackThisSite B9 1.png

2024-12-17T09:43:53Z

MReiterer:

File:HackThisSite B7 3.png

2024-12-17T09:36:52Z

MReiterer:

File:HackThisSite B7 2.png

2024-12-17T09:36:45Z

MReiterer:

File:HackThisSite B7 1.png

2024-12-17T09:34:03Z

MReiterer: