Detection

Try adding any of the injection operators after the ip in IP field. What did the error message say (in English)?

Access the target via web browser.

If we enter the local host in the input field, when clicking the check button the application will send the ping command to the host provided.

The only thing we have to do is try to insert an operator after the IP

"Please match the requested format" is the anwser. Don't bother exploit the input field, this is done my intercepting with Burp (or other tool), but not required for this section.

Last updated