nerdexam
GIAC

GPEN · Question #31

Which of the following functions can be used as a countermeasure to a Shell Injection attack? Each correct answer represents a complete solution. Choose all that apply.

The correct answer is B. escapeshellarg() C. escapeshellcmd(). Shell injection attacks are mitigated in PHP using escapeshellarg() and escapeshellcmd(), which sanitize user input before it is passed to shell commands.

Web Application Penetration Testing

Question

Which of the following functions can be used as a countermeasure to a Shell Injection attack? Each correct answer represents a complete solution. Choose all that apply.

Options

  • Aregenerateid()
  • Bescapeshellarg()
  • Cescapeshellcmd()
  • Dmysql_real_escape_string()

How the community answered

(23 responses)
  • A
    9% (2)
  • B
    74% (17)
  • D
    17% (4)

Why each option

Shell injection attacks are mitigated in PHP using escapeshellarg() and escapeshellcmd(), which sanitize user input before it is passed to shell commands.

Aregenerateid()

regenerateid() is not a standard PHP function; the related function session_regenerate_id() is used to prevent session fixation attacks and has no relevance to shell injection prevention.

Bescapeshellarg()Correct

escapeshellarg() wraps a string in single quotes and escapes any existing single quotes within the string, ensuring that user-supplied input is treated as a single safe argument and cannot inject additional shell commands.

Cescapeshellcmd()Correct

escapeshellcmd() escapes shell metacharacters such as semicolons, pipes, and backticks in a command string, preventing attackers from appending or chaining additional shell commands through user input.

Dmysql_real_escape_string()

mysql_real_escape_string() escapes special characters for safe use in MySQL queries, making it a countermeasure for SQL injection - not shell injection - and it is also deprecated in modern PHP.

Concept tested: Shell injection countermeasures using PHP escape functions

Source: https://www.php.net/manual/en/function.escapeshellarg.php

Topics

#shell injection#escapeshellarg#escapeshellcmd#input sanitization

Community Discussion

No community discussion yet for this question.

Full GPEN Practice