Let's talk about how we can prevent these vulnerabilities now and these exploits we were able to run
any code we wanted on the tablet computer.
Again this functionality should be avoided you should avoid allowing users to run any sort of code on
your server.
Try to avoid all these functions such as the evil pass through and all of these functions that allow
a user to run operating system code on the server.
If you absolutely have to use something like it then make sure you analyze the input before you execute
it.
For example in the example we've seen where the code was doing a ping and it will think anything we
put in the text box so I'm put in here as Slashdot text box just to show that this is the input that
we put in the text box.
This is what the program actually looks like.
If it looks too complicated forget about it we're just talking about the concept here.
So we're going to be talking about this here.
So say for example you put what we did is we put normal IP and then we put the semi-colon and then we
put a command that we wanted to do so we did for example LS alike.
The problem with this is the Web Application used to take this the way it is copy it and run it in here
which will when you when you execute this command it will do the ping first and then it will do the
LS L.A. which is the command that we wanted.
What you need to do is for example if you had to do it what I advise is you just don't use these functions
if you have to use a function a function like this.
Then what you should do is check that the input is what you're expecting.
For example you expected an IP address and nothing else.
So you can use regex to make sure you're not going to talk about projects or what Rodricks is Rodricks
is basically a rule that will make sure that the input looks on the following format so it takes a digit
digit that digit digit thought digit digit that digit digit which if I put anything else then the web
application should refuse it.
And this is exactly what the high security level does for the code.
So I know we're talking about black box testing and everything but I want to show you what your code
should look like.
So if we go to the security settings and I'm going to set this too high this is actually called impossible
and the new versions of a DVD I bought were used in the one that comes with me that's floatable and
it's just called high.
So the reason why they call it impossible because it's very secure.
So if you go to the command execution again and I'm just going to give you the source to show you what
they're doing.
So they're implemented in a way very similar to use and projects.
I think user projects could be a bit nicer for in terms of like the look of the code but there isn't
the same concept.
So basically what they have is they have the targets right here.
So this is what you input this is what we put in here.
So whatever you type in here is going to come up as this variable right here these last dollar target.
So the first thing that they're doing is they're strip and the slashes from it after they do that.
They're dividing the IP using this function.
So what this function does is device the IP based on the dot.
So we have number number that number number that number number that number number.
So dividing this thought into an array.
So for example if you have an IP that say
so when we put our IP which is 10 20 14:2 or 8 what this function does what the explode function does
right here it'll divide this into four and into an array of four elements.
So the arrays is going to be something like this.
It will be 10 20 14 troit OK.
And each one of these elements can be accessed based on a number right here.
So what they do is they check if each one of these elements is a number so it checks if it's numeric
for the updates for the 0 for the one for the two and for the three and that checks for this element
this element this element and this element.
So they're making sure that we have a number number number number.
So we try to inject our code right here regardless of what characters we use a word what tricks we use.
As long as we're going to put characters in here for example P.W. the characters are going to go into
here as well into the last element.
And one this last element gets checked in using this function using the is numerus function.
It will give an error because obviously this is not number two or eight semicolon PWT is not a number.
And that will give us an error saying that we have entered an invalid IP.
So the best way to do this again is to make sure what the user imported is what you're expecting.
In this case we're expecting a number number number number Dauth number number number that number number
number number number number so divided this into four arguments and make sure each one of these elements
is a number will help us to protect this input and validate the input that it is correct.
And it won't be and hackers won't be able to use it to hack into our server.