How to Test for OS Command Injection in Web Apps
OS command injection happens when an app builds a shell command using user input.
If separators like ;, &&, or | are not neutralized, an attacker may run extra commands on the server.
Quick takeaway: Find features that call system tools → inject separators carefully → prefer OOB/time proofs on production → never run destructive commands.
Features that often shell out
- Ping / traceroute diagnostics
- Site “fetch URL” helpers that call curl/wget
- Image converters
- Legacy backup or report scripts
- Filename processing pipelines
Testing flow that stays professional
1) Confirm the feature hits the OS
Timing and error differences help even when output is not shown.
2) Try in-band first (labs)
If command output is reflected, detection is easy.
3) Use blind techniques when needed
Out-of-band DNS/HTTP callbacks or controlled delays can prove execution without dumping files.
4) Keep payloads boring
Proof of id or a callback beats a flashy destructive demo every time.
Report essentials
- Exact parameter
- Injection metacharacter that worked
- Proof channel (body / time / OOB)
- Impact: code execution context (which user, which host)
Fixes developers actually ship
- Avoid shells — call libraries/APIs instead
- If you must run processes, use argument arrays with no shell interpolation
- Strict allowlists for arguments
- Least privilege for the service account
Original Bugflare article. Practice with PortSwigger OS command injection labs before live hunting.