Command Injection: Escaping to the Shell
When a web app does something with your input that involves the operating system shell — pinging a server, resizing an image, encoding a video, looking up a DNS record — it often builds a shell command as a string and runs it. If your input lands in that string without being escaped or validated, you've escaped the app and are now talking directly to the OS shell.
A realistic example: the ping endpoint
A web app offers a tool to test network connectivity. When you send ?target=google.com, it runs:
system("ping -c 1 " + user_input);
Normal case: ping -c 1 google.com. But send ?target=google.com; cat /etc/passwd and the command becomes:
ping -c 1 google.com; cat /etc/passwd
The shell sees two commands separated by a semicolon. It runs both. You've just read the password file.
Command separators
- ; : Run next command unconditionally
- && : Run next only if first succeeds
- || : Run next only if first fails
...: Run command and substitute output
Real-world impact
Once in the shell, you can read files, list directories, write backdoors, steal credentials, and pivot to other systems. This is the most dangerous type of injection.