Detecting and Injecting Commands

Detection process

Detecting basic OS command injection uses the same process as exploiting it: append a command through an injection operator and observe whether the output changes from the expected result. If it does, the injection succeeded.

For advanced injections (WAFs, indirect sinks) fuzzing and code review may be needed first. This guide focuses on basic, direct injections where user input reaches a system command function without sanitization.

Injection operators

All operators work regardless of web language, framework, or OS. Exception: ; does not work in Windows CMD but works in PowerShell.

Injecting a command

Given a Host Checker app running ping -c 1 <INPUT>, a basic payload using ;:

ping -c 1 127.0.0.1; whoami

Bypassing front-end validation

If the front-end rejects a payload (e.g., “Match the requested format”) but no network request fires, validation is client-side only. Bypass by sending a raw HTTP request directly to the back-end:

1. Intercept a valid request (e.g., ip=127.0.0.1) with Burp Suite or ZAP
2. Forward to Repeater (CTRL+R)
3. Modify the ip parameter to 127.0.0.1; whoami
4. URL-encode the payload (CTRL+U) and send

A successful injection returns both commands’ output in the response.

AND operator (&&)

ping -c 1 127.0.0.1 && whoami

Executes both commands only if the first succeeds (exit code 0). Omitting the IP and starting with && would cause the first command to fail and only the second would be suppressed — both require the first to succeed.

OR operator (||)

ping -c 1 127.0.0.1 || whoami

Only executes the second command if the first fails (exit code 1). With a valid IP, ping succeeds and whoami is suppressed.

To force execution of the injected command, intentionally break the first:

|| whoami

With no IP, ping fails and the injected command runs. This produces cleaner output and a simpler payload.

Cross-injection-type operator reference

This table is incomplete — operators vary by environment and context.