Command Injection Explained

Command injection happens when an application passes user input into a system shell command without proper handling, letting an attacker run their own commands on the server. It leads straight to remote code execution. You detect it by injecting shell metacharacters and watching for command output or, when nothing is visible, a time delay.

How command injection works

An app builds a shell command using user input, for example a ping tool that runs ping against a hostname you supply. If it passes your input straight to the shell, you append your own command with a separator and the shell runs both.

Normal:   ping -c 1 example.com
Injected: ping -c 1 example.com; whoami
Result:   runs ping, then runs whoami

The metacharacters

Detecting it

1. Inject a separator and a simple command like whoami
2. Look for the command's output in the response
3. If nothing shows, try a time delay: append a sleep and watch the response time
4. If the response is delayed, you have blind command injection

example.com; sleep 10
example.com | id
example.com && cat /etc/passwd

Blind command injection

Often the output is not returned. Two techniques: time based, where a sleep proves execution by delaying the response, and out of band, where you make the server call a host you control. Blind is still fully exploitable.

Command injection vs code injection

Command injection runs shell commands. Code injection runs code in the application's language, like PHP or Python. Both are RCE, different mechanisms. Do not confuse them in a report.

Impact

Full remote code execution in the context of the web server user. From there: read files, harvest credentials, and pivot. On Linux this leads into privilege escalation, covered in Linux privilege escalation.

The fix

• Avoid calling the shell at all, use language APIs instead
• If you must, use parameterised execution that separates the command from arguments
• Allowlist acceptable input strictly
• Never build a shell string by concatenating user input

Practise this

Find and exploit command injection on lab apps, including blind cases. Free labs on Hacklido.