In o this exercise, the IP field only allowed us to input numeric values. If we intercept the response before it reaches our browser, we can edit it to accept any value, which would enable us to input the payload we used last time directly.

Objective

Learn how to intercept an HTTP request, modify its parameters, and observe how the server processes manipulated input.

Client-side validation is not a security control.

Although the browser restricts what users can enter, an attacker can intercept and modify the HTTP request before it reaches the server using a web proxy such as Burp Suite or OWASP ZAP.

Lab Summary

1. Enable Intercept in Burp Suite or ZAP.

2. Submit a normal value (1) in the IP field.

3. Capture the request:

   POST /ping HTTP/1.1
   
   ip=1
   

4. Modify the parameter before forwarding:

   ip=;ls;
   

5. Forward the request and observe the response.

Result

The server executed the injected ls command and returned a directory listing, demonstrating a Command Injection vulnerability.

Why It Worked