SecurityTube

Description: The Server-Side Includes Injection allows the exploitation of a web application by injecting scripts or SSI directives in HTML pages or executing arbitrary codes remotely. It can be exploited by injecting malicious SSI directives into user input fields of the web application and these will be executed locally by the web server and the result is presented back to the web browser. This Injection exploits a web application's failure to sanitize, validate and escape the user-supplied data before they are inserted into a server-side interpreted HTML file.
The SSI directives are injected in input fields and they are sent to the web server. The web server parses and executes the directives before supplying the page. So an attacker can execute arbitrary operating system commands, or include a foreign file in the HTML page, view the contents of the files in the server etc. through the injected HTML Page. SSI-enabled HTML files ends with the extension ".shtml", ".stm", ".shtm", or even “.html”.

MORE: http://keralacyberforce.in/server-side-includes-injection/

Tags: server side includes injection , ssi injection , ssi , serverside injection demonstration , server side includes , ajin abraham , kerala cyber force ,

Disclaimer: We are a infosec video aggregator and this video is linked from an external website. The original author may be different from the user re-posting/linking it here. Please do not assume the authors to be same without verifying.

Comments:

Login to post a comment