6

I am attempting to educate myself further on web securities using DVWA. I am stumped on Command Injection, on the high level

The help states

The developer has either made a slight typo with the filters and believes a certain PHP command will save them from this mistake.

Spoiler: trim() removes all leading & trailing spaces, right?.

They don't render correctly on here but there are three tab spaces between trim() and removes. Having said this, the trim() function removes tabbed spaces. It does apparently struggle with non-breaking spaces though (\xA0). I'm not hugely familiar with command lines but note from the source code all the symbols I would try and inject with are replaced with PHP before you can get them to do anything.

Please note - previous sources on the net say this level is uncrackable but I am using v1.9, released 2015-10-05, with the changelog noting

Renamed 'high' level to 'impossible' and created new vectors for 'high'.

So effectively this is a new challenge.

I'm running on Windows, bearing in mind this has an affect on command syntax etc. Other (older) answers point to using named pipes (FIFO) which are apparently easier on *nix systems.

Improve this question
1
  • Look closely at what the array is filtering out, and how the linux command line works. Spaces count!
    – Nicholas Neal
    Oct 27, 2018 at 2:23

1 Answer 1

Reset to default
2

It is implying that trim() doesn't remove internal spaces. For instance, it wouldn't make the command pwd && ls become pwd&&ls. Using this hint, and looking at the imperfect blacklist, you should be able to identify a weak spot in the list.

Hint: The last item in the blacklist is a clue.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .