0

I just started on secure coding.Does anyone know what type of exploit is an attacker performing by executing the code snippet?

enter image description here

3

They're trying to execute shell commands through SQL injection. The SQL Server xp_cmdshell system stored procedure lets the executor execute a shell script, and return the script's output as row data.

So if this attack would succeed, the output of that web page would (granted the column would be printed somewhere directly) display something among the lines of:

Pinging 10.10.1.2 with 32 bytes of data:

And the attacker would know this particular attack works, and work their way through more resourceful scripts to execute.

  • Thanks for your answer. I have given 4 choices: RCE,LDAP Injection, Local File Inclusion and Path Traversal. Which one is the correct answer ? – John Joe Sep 27 '18 at 8:36
  • 3
    Can't you deduce that from my answer? Enumerate (for yourself) what characteristics each of those four has, and validate whether my explanation matches any of those. – CodeCaster Sep 27 '18 at 8:37
  • 3
    Do you know what any of those choices mean? If you don't, you are taking on a material that's too advanced for your current level of knowledge. You should go back and review the basic material first before taking this test. – Lie Ryan Sep 27 '18 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.