Skip to content
HackIndex.io

OSWA · Module 12

Command Injection

Detect and exploit OS command injection on Linux and Windows, land a reverse shell, and bypass keyword and character filters.

~2 h 3 resources Last updated September 26, 2026

Command injection occurs when user input is passed into a system shell command without proper sanitization, letting an attacker execute arbitrary OS commands in the context of the web server. It is one of the most direct paths to a shell: a single injectable parameter can go straight from web request to remote code execution. Detection and exploitation differ between Linux and Windows, and real targets almost always require bypassing some input filtering.

Command Injection Discovery

Detection tests how injected shell metacharacters affect the response. In-band injection returns command output directly; time-based payloads (sleep, ping) confirm blind injection by delaying the response; out-of-band callbacks prove execution when there is no visible output. Injection points are not limited to obvious parameters: POST bodies, headers, and filenames are all candidates, and Windows targets need their own probes and PowerShell patterns.

Command Injection Exploitation

Once execution is confirmed, the goal is an interactive shell. This means choosing a reverse shell that matches the target, handling environments with no outbound TCP, upgrading a blind injection to interactive, and stabilizing the resulting shell. The chaining and delivery techniques here turn a single command into full server access.

Filter Bypass

Applications commonly blacklist spaces, slashes, and keywords. Bypasses include whitespace alternatives, slash substitution, base64/hex/octal encoding, and, on Windows, caret insertion, COMSPEC substring extraction, variable concatenation with set, and FOR /F loop execution. A methodical bypass toolkit is what turns a filtered, seemingly-safe parameter into working RCE.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

Practice

Apply the module hands-on.

All OSWA practice machines