SKF write-ups
Search…
Introduction
Cross Site Scripting (XSS)
Cross Site Scripting - Attribute (XSS-Attribute)
Cross Site Scripting - href (XSS-href)
Cross Site Scripting - DOM (XSS-DOM)
Cross Site Scripting - DOM-2 (XSS-DOM-2)
CSRF
CSRF - Samesite
CSRF - Weak
XML External Entity (XXE)
File upload
Clickjacking
Ratelimiting (Brute-force login)
HttpOnly Session Hijacking XSS
Exposed docker daemon
SQLI (Union)
SQLI (Like)
SQLI (Blind)
URL Redirection
URL Redirection - Harder
URL Redirection - Harder-2
Formula Injection
Client Side Template Injection (CSTI)
CORS exploitation
Parameter Binding
Local File Inclusion 1 (LFI-1)
Local File Inclusion 2 (LFI-2)
Local File Inclusion 3 (LFI-3)
Remote File Inclusion (RFI)
Content-Security-Policy (CSP)
Session Puzzling
Command Injection (CMD)
Python - Command Injection (CMD)
NodeJS - Command Injection (CMD)
Java - Command Injection (CMD)
Command Injection 2 (CMD-2)
Command Injection 3 (CMD-3)
Command Injection 4 (CMD-4)
Command Injection Blind (CMD-Blind)
Server Side Request Forgery (SSRF)
Server Side Template Injection (SSTI)
Insecure Direct Object References (IDOR)
Deserialisation Yaml (DES-Yaml)
Deserialisation Pickle (DES-Pickle)
Deserialisation Pickle 2 (DES-Pickle-2)
GraphQL DOS
GraphQL IDOR
GraphQL Injections
GraphQL Introspection
GraphQL Mutations
JWT Null
JWT Secret
Race Condition
Race Condition File-Write
DoS Regex
Information Leakeage in Comments
Information Leakeage in Metadata
Auth Bypass
Auth Bypass - 1
Auth Bypass - 2
Auth-bypass - 3
Auth-bypass - Simple
Untrusted Sources (XSSI)
TLS Downgrade
Client Side Restriction Bypass
Client Side Restriction Bypass - Harder
Credentials Guessing
Credentials Guessing - 2
CSS Injection (CSSI)
Prototype Pollution
Right To Left Override (RTLO)
Ldap Injection
Ldap Injection - harder
template item
Powered By GitBook
NodeJS - Command Injection (CMD)

Running the app nodeJs

First make sure nodejs and npm are installed on your host machine. After installation, we go to the folder of the lab we want to practice. "i.e /skf-labs/XSS, /skf-labs/RFI/" and run the following commands:
1
$ npm install
Copied!
1
$ npm start
Copied!
Now that the app is running let's go hacking!

Reconnaissance

The command injecion is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In the first step, the attacker needs to inspect the functioning of the web app in order to find possible injection points. When we start the application we can see that there is an image and the option to resize the image.
Now, we are going to select a value and press the button.
If we inspect the request with an intercepting proxy (we are using Burp) we can see that the application is performing a POST request to /home. In the request we send the number (in pixels) to resize the image. In the response, we can check that the image has been resized.

Exploitation

For this lab we are going to try to write in the source code the output of a command executed in the system.
First, we check the source code:
Now, we send a new HTTP request trying to write the output of the command whoami (supposing that it will be executed in the target system) at the end of the index.html (main website view) code.
Now we access the source code of the website
to check that the output of the whoami command ("root") was appended at the end of the source code. As we can see, the output of the command whoami, is showing us the priviledge of the target user in the target system and that the web app is actually vulnerable to OS command injection.

Additional sources

Command Injection | OWASP Foundation
OS Command Injection Defense - OWASP Cheat Sheet Series
Previous
Python - Command Injection (CMD)
Next
Java - Command Injection (CMD)
Last modified 2mo ago
Export as PDF
Copy link
Edit on GitHub
Contents
Running the app nodeJs
Reconnaissance
Exploitation
Additional sources