Command Injection
Last updated
Was this helpful?
Last updated
Was this helpful?
Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell.
In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.
(python) is a tool that automate Command Injection detection and exploitation.
We have to identify input vectors that may not be properly sanitized in GET and POST parameters. For this, we may fuzz parameters with following wordlists and tools.
In Unix-like command-line interfaces, the -- symbol is used to signify the end of command options. After --, all arguments are treated as filenames and arguments, and not as options.
Following payloads are both Unix and Windows supported
; (Semicolon): Allows you to execute multiple commands sequentially.
&& (AND): Execute the second command only if the first command succeeds (returns a zero exit status).
|| (OR): Execute the second command only if the first command fails (returns a non-zero exit status).
& (Background): Execute the command in the background, allowing the user to continue using the shell.
| (Pipe): Takes the output of the first command and uses it as the input for the second command.
$IFS is a special shell variable called the Internal Field Separator. By default, in many shells, it contains whitespace characters (space, tab, newline). When used in a command, the shell will interpret $IFS as a space. $IFS does not directly work as a seperator in commands like ls, wget; use ${IFS} instead.
In some shells, brace expansion generates arbitrary strings. When executed, the shell will treat the items inside the braces as separate commands or arguments.
Input redirection. The < character tells the shell to read the contents of the file specified.
The tab character can sometimes be used as an alternative to spaces. In ASCII, the tab character is represented by the hexadecimal value 09.
In Windows, %VARIABLE:~start,length% is a syntax used for substring operations on environment variables.
We may extract data char by char
A polyglot is a piece of code that is valid and executable in multiple programming languages or environments simultaneously. When we talk about "polyglot command injection," we're referring to an injection payload that can be executed in multiple contexts or environments.
We can use ffuf and the or wordlists.
For DNS based exfiltration, you may see .
