Shulou(Shulou.com)05/31 Report--

This article mainly introduces the example analysis of high-level command execution vulnerabilities in DVWA, which has a certain reference value, and interested friends can refer to it. I hope you will gain a lot after reading this article.

Switch the DVWA Security to the high level and view the web page source code in Command Execution.

First of all, the obtained IP address is processed with the stripslashes function, mainly to remove the slash added after the escape. The reason has been explained before. As the magic_quotes_gpc magic quotation marks of PHP are automatically enabled at the high level, all the passed-value data are automatically escaped with the addslashes () function, so it needs to be removed by the stripslashes () function.

Next, the explode function is used to "." The IP address in the $target variable is split for the delimiter, resulting in an array and assigned to the variable $octet.

Next, use the if statement to determine whether each value in the $octet array is numeric data in turn with the is_numeric function, and also use the sizeof function to determine whether the number of elements in the $octet array is 4. This judgment condition is very harsh, basically can guarantee that the user must be the correct IP address, all the previously used command execution vulnerabilities can not take effect.

But the problem here is also obvious, this filtering method only works if the command parameter is the IP address, if we want to execute other system commands, this method will not work.

Thank you for reading this article carefully. I hope the article "sample Analysis of high-level Command execution vulnerabilities in DVWA" shared by the editor will be helpful to you. At the same time, I also hope you will support us and pay attention to the industry information channel. More related knowledge is waiting for you to learn!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.