Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite
1

I'm looking for a demonstration web site that shows an example of a web site that is vulnerable to command injection: where I can inject something and get the web site to run a shell command. (This is solely for demonstration purposes, to help teach others about the dangers of command injection.) Does anyone know of any demonstration web site like this?

If the location of the command injection vulnerability is not documented publicly, please describe where the command injection vulnerability is (e.g., the page and parameter that is vulnerable). I'm not looking for a puzzle to learn how to perform command injection attacks; I'm already familiar with it. Instead, I'm looking for an example that I can use to show the problem to others.

share|improve this question
1  
Download webgoat... stay off the network when running the webgoat on your machine.. There is dedicated lesson on command injection under injection attacks. Use the hints if you don't want to spend time on figuring out how to solve the lesson – Sachin Kumar Apr 11 '12 at 9:04

3 Answers

up vote 3 down vote

The WebGoat Project has a lesson specifically on command injection ;)

share|improve this answer
up vote 1 down vote

Try Hack This Site. It has examples, in the form of "puzzles," of a number of vulnerabilities.

share|improve this answer
Can you tell me which "missions" on Hack This Site demonstrates a shell command injection vulnerability? There are a lot of missions there. (Also, are there any "missions" that demonstrate this flaw with a realistic-looking site?) – D.W. Apr 11 '12 at 7:33
Update: basic7 seems to be an example of shell command injection, though the web site provides only super-limited emulation of the behavior of a vulnerable app and is a non-realistic example. realistic11 has a command injection and is a realistic-looking website, but it provides super-limited emulation of the command injection vulnerability which prevents exploiting it in the most natural ways (e.g., providing any command to run on the server other than ls). – D.W. Apr 11 '12 at 7:49
up vote 0 down vote

this vulnerable web application will help you understand OWASP top 10 and you can find command injection vulnerable pages in it , try them and here is the link mutillidae

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.