OS Command Injection
Shell Command Injection
0 / 4 solved
Find server features that build operating-system commands from user-controlled values and test common filter bypasses.
Quick reference
OS command injection cheat sheet
Look for server features that pass user-controlled values into operating-system utilities, then test whether shell syntax changes the command that actually runs.
Where to look
- Ping, traceroute, DNS lookup, image/video conversion, archive/backup tools, PDF generation, git wrappers, log viewers, and maintenance utilities.
- Pay attention to parameters named host, ip, file, path, domain, target, command, format, or options.
- Use the application's normal output and errors to infer which system command may be running behind the feature.
Simple checks
- Start with harmless separators and proof commands in training targets only.
- If one separator is blocked, compare how the filter handles other shell operators, encoded newlines, and shell expansion.
- Observe whether filtering happens before or after URL decoding/normalization.
127.0.0.1; idexample.com && id127.0.0.1%0aiduname${IFS}-aRealistic tips
- Prefer harmless commands such as id, whoami, or uname in authorized labs; the goal is proving command execution, not damaging the host.
- Blocklists are fragile because shells have many separators, expansions, quoting rules, and decoding layers.
- The robust fix is to avoid a shell, pass arguments as an array to a fixed executable, and validate inputs against the exact expected format.