Web Security intermediate 45 mins

Command Injection

Learn how unsafe system command construction leads to command injection and how to prevent it.

Hands-on Labs

Real-world Scenarios

Immediate Feedback

1

Understanding Command Injection

theory

Learn the basics of command injection vulnerabilities

Understanding Command Injection

What is Command Injection?

Command injection allows an attacker to execute arbitrary OS commands on the server by manipulating inputs to insecure system calls.

Knowledge Check

What is Command Injection?

2

Command Injection Types

theory

Understand different types of command injection

Command Injection Types

Types of Command Injection

• Blind command injection
• Time-based command injection
• Out-of-band command injection

Knowledge Check

Which of the following is NOT a type of command injection?

3

Basic Command Injection

simulation

Practice basic command injection with simple payloads

Simulation Objective

Practice basic command injection with simple payloads

Target

/safe-simulation

Scenario

Ping feature

4

Command Injection with Pipes

simulation

Use pipe operators for command injection

Simulation Objective

Use pipe operators for command injection

Target

/safe-simulation

Scenario

Ping filter semicolon

5

Blind Command Injection

simulation

Practice blind command injection techniques

Simulation Objective

Practice blind command injection techniques

Target

/safe-simulation

Scenario

Blind injection

6

Command Injection Prevention

theory

Learn how to prevent command injection vulnerabilities

Command Injection Prevention

Prevention

• Validate and sanitize all inputs
• Use safe, parameterized APIs instead of shell calls
• Avoid invoking system commands entirely when possible

Knowledge Check

What is the BEST way to prevent command injection?

7

Advanced Command Injection

simulation

Practice advanced command injection with encoding

Simulation Objective

Practice advanced command injection with encoding

Target

/safe-simulation

Scenario

Filter bypass

8

Command Injection in Web Shells

theory

Understand how command injection relates to web shells

Command Injection in Web Shells

Web Shells

Command injection can be leveraged to upload or execute web shells, providing persistent access.

Knowledge Check

How does command injection relate to web shells?