[email protected]
Login
Sign Up
final logo black 300
  • Demonstration
  • About
  • Project Planner
  • Portfolio
  • Service
  • Blog
  • Contact
final logo black 300
  • Demonstration
  • About
  • Project Planner
  • Portfolio
  • Service
  • Blog
  • Contact
  • Demonstration
  • About
  • Project Planner
  • Portfolio
  • Service
  • Blog
  • Contact
final logo 300
  • Demonstration
  • About
  • Project Planner
  • Portfolio
  • Service
  • Blog
  • Contact
Blog
Home Internet DVWA Lesson 2: Command execution (Low)
InternetSecuritySoftwareWeb Development

DVWA Lesson 2: Command execution (Low)

[email protected] August 21, 2015 0 Comments

Good ol’ command execution

First Lesson: DVWA Lesson 1: Installing on Windows. Now we have everything set up on our Windows machine, we can finally begin we some fun! Login in with the password set during the previous lesson, and head towards the ‘DVWA Security’ tab on the bottom left hand side. Continue by setting the ‘Script Security’ level to ‘Low’, and clicking ‘submit’. If you’ve installed DVWA on Windows or Linux, keep in mind which when executing commands! Head over towards the ‘Command Execution’ tab:
  • Try entering ‘192.168.1.1’, what happens?
  • Are you able to execute any other commands?
  • No? Time to read the source, located at: DVWA-1.0.8/vulnerabilities/exec/source/low.php
<?php

if( isset( $_POST[ 'submit' ] ) ) {

$target = $_REQUEST[ 'ip' ];

// Determine OS and execute the ping command.
if (stristr(php_uname('s'), 'Windows NT')) {

$cmd = shell_exec( 'ping ' . $target );
$html .= '<pre>'.$cmd.'</pre>';

} else {

$cmd = shell_exec( 'ping -c 3 ' . $target );
$html .= '<pre>'.$cmd.'</pre>';

}

?>
As we can see, the $target variable contains our user input. Fortunately for us it’s not being sanitized when passed to the shell_exec function. Allowing for our commands to cause malicious behaviour. As we’re hosting DVWA on a Windows Operating System we’re able to run commands consecutively by using ‘&’ in-between each one. Try out the commands bellow, or your own, if you feel confident in a Windows Terminal environment. Examples
  • “127.0.0.1 & tasklist” – List the hosts current processes
  • “127.0.0.1 & netstat -a”- Gives us the current ports opened on the host
Further reading
  • Stack Overflow Post Code Injection
Command Execution Low Damn Vulnerable Web App DVWA Hacking
67
4021 Views
DVWA  Lesson 1: Installing on WindowsPrevDVWA Lesson 1: Installing on WindowsAugust 21, 2015
Search Engine Optimisation (SEO) – SimplifiedAugust 21, 2015Search Engine Optimisation (SEO) – SimplifiedNext

Related Posts

Security

Have you ever wondered what sort exposure an old email might have?

Information Gathering Have you ever wondered what sort exposure an old email might...

[email protected] May 20, 2019
InternetSecuritySoftwareWeb Development

DVWA Lesson 2: Command execution (Low)

Good ol’ command execution First Lesson: DVWA Lesson 1: Installing on...

[email protected] August 21, 2015

Claim Your FREE Hotjar Alt!

FREE Heatmaps!

FREE Recordings!

FREE Qualifying Leads!

UNLIMITED Requests!

Get Started

Categories

  • App Development 4
  • Business 10
  • CTA 1
  • Digital Marketing 14
  • eCommerce 2
  • Interesting 5
  • Internet 4
  • Security 4
  • SEO 12
  • Small Business 6
  • Social Media 1
  • Social Media Marketing 5
  • Software 3
  • UX Design 2
  • Web Design 8
  • Web Development 4

Tags

analytics binary binary lesson bournemouth city Command Execution Low computer science Damn Vulnerable Web App design digital DVWA Google Hacking Installing Damn Vulnerable Web App integer Local SEO marketing mobile apps Off-Site SEO On-Site SEO Search Engine Optimization Searching seo SEO Guide targeting UX design Windows

Recent Posts

  • 7 Ways to Teach Kids About Web Design
  • Email Marketing Strategy and Tips for Successful Campaigns
  • 6 Ways Project Managers Stay Organized
  • 5 Marketing Resources You Need To Be Using
  • How to Promote Your New Small Business for Free

via.vision have much planned for the future, working with great clients and continued software development. If you'd like to join our team, then we'd also love to hear from you. https://via.vision/sitemap.xml
Services
CMS & e-Commerce Sites
Martketing & SEO
Social Media Marketing
Email Marketing
Pay Per click
Service Analytics & Reporting
Contacts
Website: via.vision
Email: [email protected]
Newsletter