Command Injection | 2nd | week 1 |.
Welcome to the 3rd course of the fundamentals of computer and network security specializations. Hacking and patching, it is a short course title, but it says it all. This course learn how to hack web application with command injection vulnerability. In the demo we'll entered only four characters to malicious as a malicious string like &Ls& which will expose the victim directory. This is a short list malicious attack, I know. We learn to launch any Unix command including cat to show the file content on the victim system and possibly we review the passwords. We will drop single line php code as a Trojan, so that we can come back later. We'll learn how to hack web application with database backend with SQL injection vulnerability and potentially show the list of password hiding in the database, by injecting twelve characters string to override an SQL query. We also learn how to perform code review, to spot the command injection or SQL injection pattern. For example they may not have immediate input validation code right after that input. They don't have immediate exit when detect an error. They don't have- They utilize generic system code instead of a specialized specific function code. We learn to apply security design pattern in writing code so that we can avoid injection attack, and enhanced the web security. We also learn the eight steps hacker methodology for systematically exploit system. We then understand the buffer overflow attack and deploy their defense. We will learn performing the vulnerability scanning using the tool called Nessus.