Good ol’ command execution

First Lesson: DVWA Lesson 1: Installing on Windows.

Now we have everything set up on our Windows machine, we can finally begin we some fun! Login in with the password set during the previous lesson, and head towards the ‘DVWA Security’ tab on the bottom left hand side. Continue by setting the ‘Script Security’ level to ‘Low’, and clicking ‘submit’.

If you’ve installed DVWA on Windows or Linux, keep in mind which when executing commands!

Head over towards the ‘Command Execution’ tab:

• Try entering ‘192.168.1.1’, what happens?
• Are you able to execute any other commands?
• No? Time to read the source, located at: DVWA-1.0.8/vulnerabilities/exec/source/low.php

<?php

if( isset( $_POST[ 'submit' ] ) ) {

$target = $_REQUEST[ 'ip' ];

// Determine OS and execute the ping command.
if (stristr(php_uname('s'), 'Windows NT')) {

$cmd = shell_exec( 'ping ' . $target );
$html .= '<pre>'.$cmd.'</pre>';

} else {

$cmd = shell_exec( 'ping -c 3 ' . $target );
$html .= '<pre>'.$cmd.'</pre>';

}

?>

As we can see, the $target variable contains our user input. Fortunately for us it’s not being sanitized when passed to the shell_exec function. Allowing for our commands to cause malicious behaviour. As we’re hosting DVWA on a Windows Operating System we’re able to run commands consecutively by using ‘&’ in-between each one.

Try out the commands bellow, or your own, if you feel confident in a Windows Terminal environment.

Examples

• “127.0.0.1 & tasklist” – List the hosts current processes
• “127.0.0.1 & netstat -a”- Gives us the current ports opened on the host

Further reading

• Stack Overflow Post
  Code Injection

Damn vulnerable what?!

DVWA (Damn Vulnerable Web App) was made by security professionals, for researchers and enthusiasts to practice and learn different types of vulnerabilities in relation to web applications which can also be used for other things such as software activation keys. Before continuing it must be stressed that the testing of DVWA should be done on an isolated host with either VMware or Virtual Box, separated by a Host-only connection. This is for your safety, not doing so could lead to the compromise of your system. You can store the files on an external hard drive or a USB drive. You can purchase USB drives online from Amazon.

Software:

• Xampp – Download
• DVWA – Download
• VMware Player – Download

Further reading:

• Host-Only Networking
• Difference Between NAT/Bridged/Host-Only
• Understanding NAT

WARNING: THIS IS FOR EDUCATIONAL PURPOSES ONLY!

• Firstly install Xampp for windows. Then continue on by opening up the Xampp Control Panel, either placed on your desktop, Program files or already started on the bottom left of the screen. Lastly, start your MySQL and Apache services.

• Extract the dvwa folder to this location C:\xampp\htdocs\dvwa. We now open our webrowser and enter ‘localhost/dvwa’ (127.0.0.1/dvwa) into the url bar. If we are presented with a mysql.error() that means the database was unable to be created, but easily fixed in step 3.

• Go on over to C:\xampp\htdocs\dvwa\config\config.inc.php and use your favourite editor to open the file, scroll down to line 20. We now enter the default PHPMyAdmin, in the db_password field, replacing the current one with nothing. Leaving it empty (no spaces)

• Jump to your browser and go to 127.0.0.1/dvwa/setup.php, and click ‘create Database’ Then go to localhost/dvwa/login.php and enter your user name ‘admin’ and password ‘password’.

Next Lesson: DVWA Lesson 2: Command execution Low

Ever wondered what UX Design is? You have probably heard your tech-savvy friends talking about it during a conversation – where you already have no clue what they are talking about. Not quite as confusing as IQ, PQ and OQ acronyms for the quality control industry but UX stands for User Experience. The experience of being the clueless odd one out is frustrating. Most of the time it makes you feel dumb. Continue on reading, as I’m keen to share what I know and enlighten you about the subject regardless if you’re just curious or wanting to branch out from your old discipline of design. So let me guide you through the “What”, the “Why” and the “How” of the subject. Basically the baby steps for now, because we’ll be here till the proverbial cows come home.

What is UX Design?

Starting with the question of ‘what is it’? It’s a User-Centric design discipline with several facets that need to be addressed and the User’s Experience (UX) is at the heart of it all. I know what you’re thinking… that was quite a mouthful to digest. Don’t worry, as I’ll break it down for you. As illustrated in the diagram below, it expresses a multitude of facets that create the user experience. It’s quite a detailed and thorough process; you’re essentially conceptualizing an experience and then creating it. As you can tell I’ve been emphasizing a particular word that is a defining factor amidst all of this: Experience. Because that’s what it’s all about.

The most common example of user experience is an interaction between the user and a systems user-interface, such as using a smart phone. You swipe left, swipe right and you press on the particular app you want to use. An easy experience for anybody. Features like this contribute to constituting a user Experience. However that is merely the beginning, as UX DESIGN essentially aims for a positive and memorable experience for the user and this is when the other factors come into play, even before the interaction. A good example for good UX is the iPhone by Apple. The iPhone UX is so simple it contributes to the brands image, reputation and fits very well. Fun fact even the marketing contributes to a good UX (such as stepping into the apple store itself).

The spectrum of User Experience Design

Why UX Design?

At this stage you’re probably wondering why is it such a big deal? It is a big deal. To put it quite simply: we are dealing with and catering to the needs of the user. It’s not rocket science. To justify the need of good UX is easy, because it has a several facets that constitute the experience as a whole. Websites have become bigger, more complex and brimming with additional features – this has taken away the simplicity from the user experience. Not only have websites have become bigger and complex but they have become more accessible from different devices other than just desktop computers; such as through mobile, tablets, and even the television! This has created a need for greater UX Design to tackle these problems. To simplify what is complicated, and to give users a better experience without sacrificing the additional features, and making it accessible on the many new platforms available.

How can UX be done?

Now we must conclude this article by settling the question of “how can this be done?” As I said before, it’s quite a thorough process. There are several tasks that a UX Design performs at different parts of the process, such as evaluations of a current system, Option A VS B Testing, surveys, wireframes and prototypes. The list goes on.

Example wireframe

For now let’s look at the technique of Wireframing as an example. As you can see this technique is pretty simple to grasp, because all you’re doing is just simply plotting how where features will be placed prior to development. If you’re resourceful enough, you can also do this on pen and paper.  Take into account these wireframes are derived from evaluations, testing’s, surveys etc.  So take your time at this part of the process. At this point the importance of UX DESIGN should be abundantly clear.

I hope this article helps you as much as it helped me sharing it.

Images credited to the respective owners:

UX Spectrum – http://randsinrepose.com/archives/a-design-primer-for-engineers/
Wireframe example – http://webarmy.co.nz/portfolio/
For a more in-depth read on UX check out this great UX Checklist