Command Injections: Hack the Box Module 109

Command Injections: Link to challenge: https://academy.hackthebox.com/module/109 (log in required) Class: Tier II | Medium | Offensive Exploitation Detection: Question: Try adding any of the injection operators after the ip in IP field. What did the error message say (in English)? Answer: Please match the requested format. Method: lets open the target server website: http://: Lets enter the input 127.0.0.1; We get the input error. Injecting Commands: Question: Review the HTML source code of the page to find where the frontend input validation is happening. On which line number is it? Answer: 17 Method: lets open the page source code (right click the page à View Page Source): We can see the regex pattern the ip input can take. Other Injection Operators: Question: Try using the remaining three injection operators (new-line, &, |), and see how each works and how the output differs. Which of them only shows the output of the injected command? Answer: | Method: ‘|’ is a pipe, and unlike new-line and (‘\n’) ‘&’ does not adds any additional output but works with the current input we get. Lets open the ping request in burpsuite repeater (all about burpsuite repeater can be found in ‘Using Web Proxies’ writeup – ‘Repeating Requests’ section (page 5). we will run each of the URL-encoded characters ‘\n’, ‘&’, ‘|’ in additional to the IP, in the request body, followed with the command ‘whoami’: (‘\n’ = %0a, ‘&’ = %26, ‘|’ = %7c) Fow ‘127.0.0.1%7cwhoami’ we will get only the ‘whoami’ ouput: