Command Injection

Introduction

Web applications frequently execute commands on the underlying operating system as part of their normal functionality. When a developer builds an application that takes user input and passes it into a system command without proper checks, an attacker can inject additional commands alongside the legitimate ones. This is command injection, a vulnerability that allows arbitrary OS-level commands to be executed through a vulnerable application.

The injected commands run with the same privileges as the application itself. If a web server runs as a user called joe, every injected command executes as joe and inherits whatever permissions that account holds. If the application runs with elevated privileges, the impact scales accordingly.

You may hear command injection referred to as "Remote Code Execution" (RCE). The two concepts are related but distinct. RCE describes the broader outcome where an attacker gains the ability to execute code on a remote system. Command injection is one specific technique for achieving that outcome. Other techniques such as insecure deserialization or memory corruption can also lead to RCE.

In the OWASP Top 10:2025, this vulnerability falls under A05: Injection. OS command injection specifically maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Even though injection has dropped a couple of positions compared to earlier editions of the list, it remains one of the most widely tested and exploited vulnerability classes.

In this room, we cover what command injection is, how it arises in application code, how to detect and exploit it, and how to prevent it. The final task provides a hands-on practical where you will exploit a vulnerable application to retrieve a flag.

Learning Objectives

By the end of this room, you will be able to:

• Explain what command injection is and why it poses a critical risk to applications
• Understand how unsafe use of system calls in application code introduces this vulnerability
• Distinguish between blind and verbose command injection and know how to detect each
• Exploit command injection using shell operators and common payloads on both Linux and Windows
• Apply remediation techniques such as input sanitisation and the use of safe APIs
• Perform command injection against a live target to retrieve sensitive data

Prerequisites

This room assumes familiarity with basic Linux commands and shell operators. If you are not comfortable with these yet, complete the Linux Fundamentals module first. The room also includes code examples in PHP and Python. You do not need to be proficient in either language, but a basic understanding of how web applications handle user input will help. The Web Fundamentals path is a useful starting point if you need to brush up.