Injection in a shell

Using a system call

name =

Call the system with escapeshellcmd

name =

Call the system with escapeshellarg

name =

Using a passthru call

name =

Try the following hacks

  • `ls ../../..` : To see the content of any directory
  • $(cat /home/bie1/.emacs) : sees the content of the emacs config file for the user BIE1.
  • ; touch /tmp/myfile.txt : Creates a new empty file
  • Hello World | wc : Counts the number of words in Hello World (wc = words count).
  • && ls :
  • test > /tmp/test2.txt : You can create a file with some contents (here, we make a echo of test which is put inside the new file).
  • < /tmp/test2.txt : Gives the content of the file as arguments to the echo.