Which attack type involves injecting shell commands through crafted inputs to the server?

Which attack type involves injecting shell commands through crafted inputs to the server?

• A. Shell Injection
• B. LDAP Injection
• C. Server-side JavaScript injections
• D. HTML Embedding

Answer: (A)

Shell injection is the act of feeding crafted input to an application in a way that the input becomes part of a command interpreted by the server’s shell. When the app passes unsanitized input to a command interpreter, an attacker can append or insert commands that the shell will execute, giving the attacker control over the server or access to its data. This vulnerability relies on the presence of a system shell and the ability to influence the command line that gets executed, so the attacker can run arbitrary commands with the server’s privileges. This matches the option that describes injecting shell commands through inputs to the server. Other types focus on different targets: LDAP injection alters directory-service queries, server-side JavaScript injections aim to run injected code within the server’s JS engine, and HTML embedding typically results in client-side rendering rather than executing commands on the server.

Shell injection is the act of feeding crafted input to an application in a way that the input becomes part of a command interpreted by the server’s shell. When the app passes unsanitized input to a command interpreter, an attacker can append or insert commands that the shell will execute, giving the attacker control over the server or access to its data. This vulnerability relies on the presence of a system shell and the ability to influence the command line that gets executed, so the attacker can run arbitrary commands with the server’s privileges.

This matches the option that describes injecting shell commands through inputs to the server. Other types focus on different targets: LDAP injection alters directory-service queries, server-side JavaScript injections aim to run injected code within the server’s JS engine, and HTML embedding typically results in client-side rendering rather than executing commands on the server.