Mastering Kali Linux for Web Penetration Testing

Code injections

A code injection is used to implement what are known as buffer overflow attacks. Rather than pop-up messages to demonstrate that the vulnerability exists, these attacks focus on using these cracks in the application's security validation to execute arbitrary code that allows the attacker to take over their target, or use the compromised server as a pivot into the environment. Simply put, if a website is running on PHP or ASP and passes information via URL query, you can look for a code injection flaw by simply identifying the tell-tale string, showing that page redirection is accepted, in the source for our page:

/bWAPP/phpi.php?message=test

While this is a pretty benign test path (we're not looking to do harm) we can exploit ...