Command injection by adding query parameters
This test explores various query parameter names for potential command injection, such as cmd, exec, command, execute, ping, and query.
Command Injection
How this template works
APIs Selection
The API selection filters in this template specify the desired response code range. In this case, it filters for response codes that are greater than or equal to 200 and less than 300, indicating a successful response.
Execute request
The execute section of the template defines a single request to be executed. It uses the "add_query_param" action to add query parameters to the request. Each query parameter is given a name (e.g., "cmd", "exec", "command") and a corresponding value (e.g., "echo 'hello world'"). This simulates a potential command injection by adding query parameters that resemble common command execution keywords.
Validation
The validation section specifies the expected response payload. In this case, it checks if the response contains the string "hello world'. If the response payload contains this string, the validation is considered successful, indicating that the command injection vulnerability may be present.
Frequently asked questions
What is the purpose of the "Command injection by adding query parameters" test
What are the potential impacts of a successful command injection exploit
What category and subcategory does this test fall under
What are the severity and tags associated with this test
What are the query parameters used in the test
What is the validation criteria for this test
"The text editor in Akto is absolutely remarkable. Its user-friendly YAML format strikes the perfect balance between simplicity and power. With intuitive features like 'API selection filter', 'Execute', Validate' creating test rules becomes incredibly easy. Akto's test editor is a game-changer, enabling seamless creation of highly personalized and effective tests that could meet the needs of any modern day organization. "
Security team,
Rippling
