At a university, a lab form passes a student-supplied field into a server shell command, and the page returns a directory listing from that server. Which attack produced the listing?
Select an answer to reveal the explanation.
Short Explanation
You handed the cook a note, and the kitchen answered by reading the pantry aloud. You passed a form field into a server shell, and the directory listing is that command's output. The trap is calling every unexpected page either a database trick or a browser script.
Full Explanation
Command injection places operating-system syntax into input that an application concatenates into a shell command, so the server runs the attacker's command and returns the output. A directory listing from the server, after the form field was passed into a shell, is that output. A shell command inserted from the form and executed on the server that returned the directory listing matches the evidence. A database query rewritten with a quote so extra student rows are returned from the lab database to the browser would manipulate a query and typically return rows or a database error, not a shell listing of the server. A script aimed at a classmate browser that runs only when that classmate opens the lab page later executes in a browser, and it does not make the server print its own directories. A forged address-resolution reply that redirects the lab workstation toward a different campus host poisons name resolution on the local network and is not produced by a form field passed to a shell. On the exam, match the sink: a shell sink is command injection even when the visible result looks like data coming back. In operations, find the server command that includes the form field and preserve the process and the listing it produced.