An attacker crafts an input string to gain shell access to a web server. What is this attack commonly called?

An attacker crafts an input string to gain shell access to a web server. What is this attack commonly called?

• A. HTML Embedding
• B. Shell Injection
• C. LDAP Directory Services
• D. log injection attacks

Answer: (B)

Shell injection happens when untrusted input is passed to a shell or command interpreter, and the input isn’t properly sanitized. If a web app builds a system command using user-provided data, an attacker can craft input that terminates the intended command and appends their own commands. This can allow the attacker to run arbitrary commands on the server, potentially giving them a shell with the server’s privileges. The key idea is leveraging the command context and unsanitized input to execute additional commands. HTML embedding is about inserting markup or scripts into a webpage (often leading to XSS), not executing shell commands. LDAP directory services involve a directory access protocol, not a command-injection attack. Log injection attacks aim to alter log files, not gain shell access.

Shell injection happens when untrusted input is passed to a shell or command interpreter, and the input isn’t properly sanitized. If a web app builds a system command using user-provided data, an attacker can craft input that terminates the intended command and appends their own commands. This can allow the attacker to run arbitrary commands on the server, potentially giving them a shell with the server’s privileges. The key idea is leveraging the command context and unsanitized input to execute additional commands.

HTML embedding is about inserting markup or scripts into a webpage (often leading to XSS), not executing shell commands. LDAP directory services involve a directory access protocol, not a command-injection attack. Log injection attacks aim to alter log files, not gain shell access.