Web SecurityCriticalShell injectionCommand Injection

OS Command Injection

User input reaches a system shell, letting an attacker run OS commands on the host.

Live Playground · Powered by this research

Command Injection Character Check

; - command chainPRESENT

& - background/chainNot present

| - pipeNot present

` - command substitutionNot present

$ - variable expansionNot present

( - subshellNot present

) - subshellNot present

< - redirectNot present

> - redirectNot present

\ - escapeNot present

\n - newlineNot present

1 shell metacharacter(s) found. Never pass this to system() / exec() / shell.

Payloads from this research (4 total)

println 'ls'.execute().text  (Jenkins)

Confluence OGNL: \u0027+#{...}+\u0027  with new Runtime().exec(...)

Telerik DialogHandler payload (CVE-2019-18935)

All payloads from the broader Command Injection synthesis

These payloads were synthesized from real HackerOne disclosures. Click any payload to copy it, then paste it into the tester above to see how our detection classifies it.

Overview

When applications build shell command strings with untrusted input, shell metacharacters (; | && $() ` ) inject additional commands that the OS executes with the app’s privileges.

How it works

When applications build shell command strings with untrusted input, shell metacharacters (; | && $() ` ) inject additional commands that the OS executes with the app’s privileges.

Example

bash

# input: 8.8.8.8; cat /etc/passwd
ping -c1 "8.8.8.8; cat /etc/passwd"

Impact

Arbitrary command execution, file access, credential theft, and full host takeover.

Detection

Inject time-delay and OAST command payloads (sleep, nslookup to a collaborator) and confirm via latency or callback.

Prevention

Avoid the shell - use argument arrays / exec APIs without a shell.
Never interpolate input into command strings.
Allowlist and strictly validate any values passed to system calls.
Run with minimal OS privileges.

Real-world HackerOne reports

Sampled from 55 disclosed reports analyzed for the OS Command Injection research playbook.

#1001255 #1125329 #1158824 #1161691 #1327701 #1327769