Differences

This shows you the differences between two versions of the page.

--- method_4_exploitation [2022/12/31 22:27] – gman
+++ method_4_exploitation [2023/01/12 00:27] (current) – [Defaults] gman
@@ Line 49: / Line 49: @@
 ----
+====== Defaults ======
+Many folks leave many devices with factory defaults. You can quickly look up the default login creds here:
+  * https://www.defaultpassword.com/
+  * https://default-password.info/
+  * https://cirt.net/passwords
+  * [[https://www.google.com/search?q=default+passwords | Or just Google "default passwords"]]. There are a ton of sites.
+----
 ====== Tools ======
@@ Line 196: / Line 205: @@
 ===== Command =====
-here
+**Command Injection Attacks:** These are attacks that attempt to send commands through a web app to the operating system.
+  * It would give you the ability to directly manipulate the o/s.
+  * On Linux, use the ''system()'' call to send commands to the o/s itself.
+**Example:** If an app asks for a username to set up an account (assuming the username dbag)
+  * When we create our account with the username "dbag," the back-end result sent to the o/s would be something like:
+    * ''system('mkdir /home/dbag')''
+  * Using command injection, you add commands to our user input:
+    * ''dbag & rm -rf /home''
+  * This would result in a command like this:
+    * ''system('mkdir /home/dbag & rm -rf /home')''
+  * And that's bad.
 ===== SQLi =====