[email protected]
Login
Sign Up
final logo black 300
  • Demonstration
  • About
  • Project Planner
  • Portfolio
  • Service
  • Blog
  • Contact
final logo black 300
  • Demonstration
  • About
  • Project Planner
  • Portfolio
  • Service
  • Blog
  • Contact
  • Demonstration
  • About
  • Project Planner
  • Portfolio
  • Service
  • Blog
  • Contact
final logo 300
  • Demonstration
  • About
  • Project Planner
  • Portfolio
  • Service
  • Blog
  • Contact
Blog
Home Internet DVWA Lesson 2: Command execution (Low)
InternetSecuritySoftwareWeb Development

DVWA Lesson 2: Command execution (Low)

[email protected] August 21, 2015 0 Comments

Good ol’ command execution

First Lesson: DVWA Lesson 1: Installing on Windows. Now we have everything set up on our Windows machine, we can finally begin we some fun! Login in with the password set during the previous lesson, and head towards the ‘DVWA Security’ tab on the bottom left hand side. Continue by setting the ‘Script Security’ level to ‘Low’, and clicking ‘submit’. If you’ve installed DVWA on Windows or Linux, keep in mind which when executing commands! Head over towards the ‘Command Execution’ tab:
  • Try entering ‘192.168.1.1’, what happens?
  • Are you able to execute any other commands?
  • No? Time to read the source, located at: DVWA-1.0.8/vulnerabilities/exec/source/low.php
<?php

if( isset( $_POST[ 'submit' ] ) ) {

$target = $_REQUEST[ 'ip' ];

// Determine OS and execute the ping command.
if (stristr(php_uname('s'), 'Windows NT')) {

$cmd = shell_exec( 'ping ' . $target );
$html .= '<pre>'.$cmd.'</pre>';

} else {

$cmd = shell_exec( 'ping -c 3 ' . $target );
$html .= '<pre>'.$cmd.'</pre>';

}

?>
As we can see, the $target variable contains our user input. Fortunately for us it’s not being sanitized when passed to the shell_exec function. Allowing for our commands to cause malicious behaviour. As we’re hosting DVWA on a Windows Operating System we’re able to run commands consecutively by using ‘&’ in-between each one. Try out the commands bellow, or your own, if you feel confident in a Windows Terminal environment. Examples
  • “127.0.0.1 & tasklist” – List the hosts current processes
  • “127.0.0.1 & netstat -a”- Gives us the current ports opened on the host
Further reading
  • Stack Overflow Post Code Injection
Command Execution Low Damn Vulnerable Web App DVWA Hacking
55
3529 Views
DVWA  Lesson 1: Installing on WindowsPrevDVWA Lesson 1: Installing on WindowsAugust 21, 2015
Search Engine Optimisation (SEO) – SimplifiedAugust 21, 2015Search Engine Optimisation (SEO) – SimplifiedNext

Related Posts

Digital MarketingSecuritySEO

The Importance of HTTPS for SEO

What is HTTPS/SSL? HyperText Transfer Protocol Secure is the communication between the...

[email protected] April 5, 2016
Digital MarketingeCommerceInternetUX DesignWeb DesignWeb Development

The Importance of UX Design

Ever wondered what UX Design is? You have probably heard your tech-savvy friends...

[email protected] August 21, 2015

Do You Need Web…

Service / Directory / Shop?

Optimize Conversion Rates?

Bulletproof Marketing?

You have come to the right place!

Get Started

Categories

  • App Development 4
  • Business 10
  • CTA 1
  • Digital Marketing 14
  • eCommerce 2
  • Interesting 5
  • Internet 4
  • Security 4
  • SEO 12
  • Small Business 6
  • Social Media 1
  • Social Media Marketing 5
  • Software 3
  • UX Design 2
  • Web Design 8
  • Web Development 4

Tags

analytics binary binary lesson bournemouth city Command Execution Low computer science Damn Vulnerable Web App design digital DVWA Google Hacking Installing Damn Vulnerable Web App integer Local SEO marketing mobile apps Off-Site SEO On-Site SEO Search Engine Optimization Searching seo SEO Guide targeting UX design Windows

Recent Posts

  • 7 Ways to Teach Kids About Web Design
  • Email Marketing Strategy and Tips for Successful Campaigns
  • 6 Ways Project Managers Stay Organized
  • 5 Marketing Resources You Need To Be Using
  • How to Promote Your New Small Business for Free

via.vision have much planned for the future, working with great clients and continued software development. If you'd like to join our team, then we'd also love to hear from you. https://via.vision/sitemap.xml
Services
CMS & e-Commerce Sites
Martketing & SEO
Social Media Marketing
Email Marketing
Pay Per click
Service Analytics & Reporting
Contacts
Website: via.vision
Email: [email protected]
Newsletter