Command Execution Testing Checklist

Command Execution Testing Checklist

Derived from 57 real-world vulnerability cases (WooYun 2010-2016)

High-Risk Parameters to Test

Attack Pattern Distribution

Vulnerability Sources (ranked by frequency)

1. Apache Struts2 OGNL Injection (~45% of cases)

The single most common command execution vector in the dataset.

• S2-045, S2-046, S2-048, S2-052 and related CVEs
• Targets: .action and .do URL endpoints
• Detection: Look for struts2 in response headers or URL patterns

Test indicators:

/login.action
/index.do
/upload.action
Content-Type: %{...}  (S2-045)

2. Java Deserialization (~20% of cases)

• JBoss JMXInvokerServlet / EJBInvokerServlet
• WebLogic T3 protocol
• Jenkins CLI
• Spring Framework

Test endpoints:

/invoker/JMXInvokerServlet
/invoker/EJBInvokerServlet
/jmx-console/
/web-console/

3. Middleware Misconfiguration (~15% of cases)

• JBoss default deployment consoles
• Resin admin panel exposed
• WebLogic console with default credentials
• Tomcat manager with weak auth

4. Application-Level Command Injection (~10% of cases)

• SAP systems: EXECUTE_CMD;CMDLINE=cmd.exe%20/c%20...
• Network management tools with ping/traceroute functions
• Monitoring systems executing OS commands

5. PHP Code Execution (~10% of cases)

• eval() with user-controlled input
• Unsafe unserialize()
• Template injection

Common Exploitation Payloads

Struts2 OGNL

%{(#context['com.opensymphony.xwork2.dispatcher.
  HttpServletResponse'].getWriter().println('test'))}

redirect:${#context...}

JBoss Deserialization

POST /invoker/JMXInvokerServlet HTTP/1.1
[serialized Java object payload]

OS Command Chaining

; whoami
| cat /etc/passwd
`id`
$(whoami)

Quick Test Vectors

1. Identify framework: Look for .action/.do URLs (Struts2)
2. Check /invoker/JMXInvokerServlet (JBoss deser)
3. Check /jmx-console/ (JBoss misconfiguration)
4. Check management ports: 8080, 9090, 4848
5. Test Struts2: Content-Type manipulation
6. Test command injection: ; whoami | id `id`
7. Check resin-admin, /manager/html (middleware consoles)

High-Value Targets

• Government systems: Frequently running outdated Struts2
• Financial/banking systems: Legacy Java middleware
• Telecom infrastructure: JBoss-based management platforms
• Enterprise OA systems: SAP, Oracle middleware
• CDN/infrastructure nodes: Internal management consoles

Root Causes