Let's talk about how we can prevent these vulnerabilities now and these exploits, we were able to run
any code we wanted on the target computer.
Again, this functionality should be avoided.
You should avoid allowing users to run any sort of code on your server, try to avoid all these functions,
such as the Eveillard Pass through and all of these functions that allow a user to run operating system
code on the server.
If you absolutely had to use something like it, then make sure you analyze the input before you execute
it.
For example, in the example we where the code was doing typing and it will pick anything we put in
the textbook.
So I'm put in here, slash the text box just to show that this is the input that we put in the textbooks.
This is what the program actually looks like if it looks too complicated.
Forget about it.
We're just talking about the concept here.
So we're going to be talking about this year.
So say, for example, you put what we did is we put a normal i.p.
And then we put the semicolon and then we put a command that we wanted to do, so we did, for example,
L.A. The problem with this is the Web application used to take this the way it is copied and run it
in here, which will when you when you execute this command, it will do the pink first and then it
will do the SLA, which is the command that we wanted.
What you need to do is, for example, if you had to do it, what I advise is you just don't use these
functions.
If you had to use a function, a function like this, then what you should do is check that the input
is what you're expecting.
For example, you're expecting an IP address and nothing else.
So you can use regex to make sure, no, I'm not going to talk about regex or what regex is.
Regex is basically a rule that will make sure that the input looks on the following format.
So it takes a digit digit, that digit digit digit digit that the digit which if I put anything else,
then the Web application should refuse it.
And this is exactly what the high security level does for the code, so I know we're talking about black
box testing and everything, but I want to show you what a secure code should look like.
So if we go to the security settings and I'm going to set this to high, this is actually called impossible
and the new versions of DVDs.
But we're using the one that comes with the floatable and it's just called high.
So the reason why they call it impossible, because it's very secure.
So if you go to the command execution again and I'm just going to give you the source to show you what
they're doing.
So they're implementing a way very similar to using rejects.
I think user objects could be a bit nicer for in terms of like the look at the code, but they're using
the same concept.
So basically what they have is they have the target right here.
So this is what you input, this is what we put in here, so whatever you type in here is going to come
up as this variable right here, these last dollar target.
So the first thing that they're doing is they're stripping the slashes from it.
After they do that, they're dividing the IP using this function.
So at this function, does it divides the IP based on the dot?
So we have no, no, no, no, no, no, no, no.
So they're dividing this dot into an array.
So, for example, if you have an IP that say.
So when we put our IP, which is 10, 20, 14 to 08.
What this function does, what the explode function does right here, it will divide this into four
into an array of four elements.
So the array is going to be something like this.
It will be 10.
Twenty, fourteen.
Toid.
OK, and each one of these elements can be accessed based on its number right here.
So what they do is they check if each one of these elements is a number.
So it checks if it's numeric for the update, for the zero, for the one, for the two and for the three.
And that checks for this element, this element, this element and this element.
So they're making sure that we have a number.
No, no, no.
So when we try to inject our code right here, regardless of what characters we use a word, what tricks
we use, as long as we're going to input characters in here, for example, the characters are going
to go into here as well, into the last element.
And when this last element gets checked and using this function, using these numeric function.
It will give an error because obviously this is not a number two or eight semicolon, Pheidippides is
not a number, and that would give us an error, saying that we have entered an invalid IP.
So the best way to do this again is to make sure what the user inputted is what you're expecting.
In this case.
We're expecting a no, no, no, no, no, no, no, no, no, no, no, no, no.
So dividing this into four elements and make sure each one of these elements is a number will help us
to protect this input and validate the input that it is correct.
And it won't be attackers won't be able to use it to hack into our server.