A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
You type 127.0.0.1; whoami into the form and get an error: "Invalid input. Please enter a valid IP address." Your first instinct might be to move on. That would be a mistake. Open your browser dev tools, check the Network tab, and you will see zero HTTP requests were sent. The validation happened in JavaScript, on your machine, before anything left the browser.
Front-end validation is a user experience feature. It prevents accidental typos. It is not a security control. The server never saw your payload. The JavaScript regex rejected it locally. But the backend PHP code still has system("ping -c 1 " . $_POST['ip']) sitting there, completely unsanitized. You just need to send the request yourself, bypassing the browser's JavaScript entirely.
Send a valid request first (just 127.0.0.1). Let Burp intercept it. Send it to Repeater with Ctrl+R. Now modify the ip parameter to your payload. The JavaScript validation never runs because you are not using the browser form. You are crafting the raw HTTP request directly.
There is your www-data. The front-end regex never got a chance to complain. The backend processed the raw POST body exactly as you sent it. This is why front-end-only validation is security theater.
Same result. curl does not execute JavaScript. It sends exactly what you tell it to send. If the backend does not validate, you are in.
Never assume a rejected payload means the backend is secure. Always test by sending the request directly via Burp Repeater, curl, or a custom script. Client-side validation is a speed bump, not a wall. I have found command injection in production applications where the 'security' was entirely a JavaScript regex on the front end.
Front-end validation is dead. You are talking directly to the backend now. But what happens when the backend itself starts rejecting your payloads? That is where filter identification begins, and it is where things get genuinely interesting.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.