Bug Bounty Hunting for Web Security: Find and Exploit Vulnerabilities in Web sites and Applications

© Sanjib Sinha 2019

S. SinhaBug Bounty Hunting for Web Securityhttps://doi.org/10.1007/978-1-4842-5391-5_9

9. Finding Command Injection Vulnerabilities

Sanjib Sinha¹ 

(1)

Howrah, West Bengal, India

 

A server that is running an application can be compromised using arbitrary operating system (OS) commands if there are certain types of web security vulnerabilities. These commands compromise the application and all its data. Not only that, an attacker can take advantage of OS command injection vulnerabilities to compromise other parts of the hosting infrastructure and finally, attack other applications related to the compromised one.

As a penetration tester, your job is to find whether an attacker can run a script into the users’ browser to inject such ...