Advanced Cyber Security (BCY504)
5. Command Injection
Objective: To learn how command injection attack works
Tools: DVWA, Burp Suit, custom vulnerable web application
Command injection is a critical security vulnerability that occurs when an attacker can execute
arbitrary commands on a host operating system via a vulnerable application. This type of attack
typically targets applications that pass user-supplied data to system commands without adequate
input validation or sanitation. Command injection can lead to unauthorized system access, data
exfiltration, privilege escalation, and sometimes even full system compromise.
How Command Injection Works
Command injection vulnerabilities occur in applications that use user input within system-level
commands without properly validating or escaping that input. Attackers can manipulate the input to
execute unintended commands, leveraging characters like ;, &&, |, or & to chain commands.
Types of Command Injection
1. Shell Injection: Directly injects commands into shell scripts.
2. OS Command Injection: Targets applications that execute system commands on the
operating system.
3. Arbitrary Code Execution: Allows attackers to run code in various languages within the
application, often leading to severe consequences.
Mitigation Techniques
1. Input Validation and Sanitization: Validate and sanitize all user input, ensuring it only
contains expected values.
2. Parameterized Commands: Use parameterized functions instead of concatenating user input
directly into command strings.
3. Use APIs Over Direct System Calls: Instead of using system commands, opt for language-
specific libraries or APIs to perform operations.
4. Least Privilege Principle: Limit the permissions of applications that run system commands
to prevent privilege escalation.
5. Escaping Special Characters: Escape any potentially harmful characters in the input to
prevent chaining commands.
Now we have learnt the basics. Let us exploit the Command Injection vulnerability in the DVWA
application at low, medium and high levels.
First of all, login into your DVWA application by default credential admin : password or something
else which you have set.
29
Advanced Cyber Security (BCY504)
1. Low Security
Step 1: In DVWA, set the security level to Low and select the Command Injection challenge
from the left panel. On the challenge page, enter a valid IP address (e.g., [Link]) to test the
functionality and observe that the application successfully pings the given IP.
Step 2: From this behavior, we understand the application is running the system ping command
in the background using the provided input.
Step 3: To test for vulnerability, append another command to the input. For example, enter
[Link] && ifconfig and notice that both ping and ifconfig commands are executed, confirming
command injection.
30
Advanced Cyber Security (BCY504)
Step 4: Try additional payloads such as [Link] && uname -a to verify that arbitrary system
commands can also be injected and executed.
Step 5: Review the source code and observe that the user input ($_REQUEST['ip']) is passed
directly into the shell_exec() function without any validation or sanitization, which is why injected
commands execute successfully.
2. Medium Security
Step 1: Change the DVWA security level to Medium and open the Command Injection
challenge.
31
Advanced Cyber Security (BCY504)
Enter a valid IP address (e.g., [Link]) to test the functionality and observe that the application
still executes the ping command in the background.
Step 2: Attempt command injection with the payload [Link] && ifconfig, but notice that it
fails with the error Bad parameter ifconfig. This indicates that some input validation is being
applied.
Step 3: Review the source code and observe that the application uses the str_replace() function to
replace characters like && and ; with spaces, which prevents these operators from working in
injected payloads.
32
Advanced Cyber Security (BCY504)
Step 4: To bypass this filter, try other concatenation characters such as &, |, or ||. For example,
submit [Link] & ifconfig and confirm that the ifconfig command executes successfully.
Step 5: Verify further by injecting another command, such as [Link] & uname -a, and observe
that the output of the uname -a command is displayed, confirming the command injection
vulnerability at Medium level.
3. Hight Security
Step 1: Change the DVWA security level to High and open the Command Injection challenge.
33
Advanced Cyber Security (BCY504)
Enter a valid IP address (e.g., [Link]) to test the functionality and observe that the application
executes the ping command in the background.
Step 2: Try command injection with payloads such as [Link] && ifconfig or [Link] &
ifconfig, but notice that both fail with the error Bad parameter ifconfig, indicating stricter input
validation.
Step 3: Review the source code and observe that it replaces additional special characters (&&, ;,
&, -, $, (, etc.) with spaces using the str_replace() function. This prevents most typical command
injection operators from working.
34
Advanced Cyber Security (BCY504)
Step 4: Notice in the source code that the filter specifically targets | (pipe followed by a space).
To bypass this, use the pipe character without a space. For example, enter the payload
[Link]|ifconfig and confirm that the ifconfig command executes successfully.
Step 5: Verify further by injecting another command such as [Link] |whoami, and observe that
the output of the whoami command is displayed, proving successful command injection even at
High security.
Ref: [Link]
Viva Questions:
1. What is a Command Injection attack?
It is a vulnerability where an attacker executes arbitrary system commands by injecting them into
input fields processed by the server.
2. How does a command injection attack work?
It occurs when an application improperly processes user input, allowing attackers to append
system commands to existing ones.
3. What tools are used to test for command injection?
DVWA, Burp Suite, and custom vulnerable web applications help analyze and exploit command
injection flaws.
4. How does Burp Suite help in detecting command injection?
It intercepts and modifies requests to test if user input is executed as a system command.
35
Advanced Cyber Security (BCY504)
5. What are common payloads used in command injection attacks?
Examples include ; ls, && whoami, | cat /etc/passwd, which execute system commands on
Unix-based servers.
6. What are the consequences of a successful command injection attack?
Attackers can execute arbitrary commands, steal data, create backdoors, and gain full control
over the server.
7. How can command injection vulnerabilities be prevented?
Use input validation, parameterized commands, allowlisted inputs, and avoid executing system
commands with user input.
8. What is the difference between Command Injection and SQL Injection?
Command Injection targets the operating system, while SQL Injection exploits database queries.
9. How does disabling unnecessary system commands help prevent command injection?
It limits the attacker's ability to execute harmful commands even if the application is vulnerable.
10. What security mechanisms can be used to detect command injection attacks?
Web Application Firewalls (WAF), intrusion detection systems (IDS), and application security
testing tools can detect and block suspicious command execution attempts.
36