OS Command Injection

Find where user input reaches a shell, then pick a payload form that survives the filter and response style.

Use shell separators, pipes, command substitution, or blind output redirection depending on how the vulnerable endpoint handles input.

Each variant changes the parameter and filter, so you practice adapting the injection instead of repeating one separator.

How the attack works

1. Find a parameter whose value looks like it feeds a shell command (ping, lookup, convert). host=127.0.0.1
2. Break out of the command with a shell separator and run your own. 127.0.0.1; id
3. If separators are filtered, try a pipe, AND, or command substitution. 127.0.0.1 | id # or $(id)
4. No visible output? Confirm blind execution with a timing probe, then exfiltrate. 127.0.0.1; sleep 5

On PwnKata the binary, account, and paths change every rep — so you drill the recognition, not this exact command.

What you'll practice

Sourced from

• OWASP — Command Injection ↗
• PayloadsAllTheThings — Command Injection ↗