- Command injection is an attack
where you try to execute commands
that you're not supposed to be able to execute
on a system via a vulnerable application.
Now, command injection attacks are possible
whenever an application doesn't validate any data
supplied by the user.
For example, you know, data that you can enter in web forms,
in cookies, HTTP headers, and many others.
Then the system passes that into a system shell.
In this attack, you try to send operating system commands,
so you can actually cause the application to execute them
with the privileges that the application
is actually running,
so the vulnerable application is running.
I want to make sure that you understand
that this attack is not the same
as code execution or code injection
that you see whenever you exploit a buffer overflow, right?
Now, command injection is not a popular attack anymore,
because a lot of modern application frameworks
have a lot better defenses against them.
Now the folks from the OWASP organization
have a good reference
on how command injection actually works,
in the link that I'm actually sharing in the screen,
but in the next lesson
we will go over a detailed example
of how actually this works,
and how to exploit these command injection vulnerabilities.