200-201 · Question #514
If a web server accepts input from the user and passes it to a bash shell, to which attack method is it vulnerable?
The correct answer is D. command injection. Command injection occurs when a web server accepts user input and passes it to a shell (such as Bash) without proper sanitization. This allows attackers to execute arbitrary system commands by injecting malicious input. For example, if a web application allows users to enter a…
Question
If a web server accepts input from the user and passes it to a bash shell, to which attack method is it vulnerable?
Options
- Ainput validation
- Bhash collision
- Cinteger overflow
- Dcommand injection
How the community answered
(20 responses)- A5% (1)
- B15% (3)
- C5% (1)
- D75% (15)
Explanation
Command injection occurs when a web server accepts user input and passes it to a shell (such as Bash) without proper sanitization. This allows attackers to execute arbitrary system commands by injecting malicious input. For example, if a web application allows users to enter a filename but fails to validate input, an attacker could submit: filename.txt; rm -rf / This would execute the rm -rf / command, potentially deleting critical system files. - Input validation is a mitigation strategy, not an attack method. - Hash collision is related to cryptographic weaknesses, not shell execution. - Integer overflow exploits numerical data limits, not command execution. Since command injection is the attack method that exploits unsanitized input passed to a shell.
Topics
Community Discussion
No community discussion yet for this question.