Command Injection Exploitation

Command injection exploitation turns a confirmed injection point into interactive access on the target. Start with command injection detection to confirm the vulnerability exists, then use the techniques below to move from confirmed execution to a reverse shell. If input filters block your payloads, see command injection bypasses for filter evasion techniques. The approach depends on whether you see command output in the response (inline injection) or not (blind injection), and whether the target has outbound network connectivity.

Confirming Execution

Before deploying a reverse shell, confirm that commands actually execute. If the application returns command output in the response, inject id or whoami and verify the result. For blind injection where no output is visible, use time-based confirmation or out-of-band callbacks.

If the response takes approximately 5 seconds longer than normal, the sleep or ping command executed. For out-of-band confirmation, use curl or wget to call back to your listener. This confirms execution and also verifies outbound connectivity for reverse shell delivery.

A hit on your HTTP server for /confirm proves execution and outbound HTTP connectivity. If DNS is the only outbound channel, use a DNS callback instead: nslookup confirm.$LHOST or host confirm.$LHOST and watch for the resolution on your DNS server or a tool like interactsh.

Choosing a Reverse Shell

Match the reverse shell to interpreters available on the target. Check what exists by injecting which bash python3 python php perl nc ncat node through the injection point (if inline output is available) or by testing each shell one at a time until a connection arrives. Start your listener before sending the payload.

Bash is the most common reverse shell on Linux targets. Available on virtually every Linux system.

Python works on targets with Python installed. Common on Linux servers and many web application containers.

PHP is available on targets running PHP-based applications. Use php -r for inline execution.

Node.js is specifically covered in WEB-200 and common on targets running Express, Next.js, or other Node-based applications.

Perl is present on many legacy Linux systems and some embedded devices.

Netcat with -e flag works on systems with the traditional netcat build. The OpenBSD variant on modern systems does not support -e, so use a named pipe alternative instead.

PowerShell for Windows targets. URL-encode the payload when injecting through HTTP parameters.

No Outbound TCP

When the target has no outbound TCP connectivity (egress filtering, firewall rules), reverse shells fail. Alternative approaches depend on what outbound channels are available.

Stage through HTTP: If the injection point's response reflects command output, use the injection itself as your data channel. Run commands one at a time and read results from the response. If you can write files to the webroot, stage a web shell through the injection and interact through HTTP requests instead of a TCP shell.

DNS exfiltration: When only DNS is allowed outbound, encode command output in DNS queries. Each query carries a limited payload, so this is slow but works when all other channels are blocked.

Watch your DNS server or interactsh listener for the resolution. The subdomain contains the command output. For multi-line output, base64 encode and split across multiple queries. If curl or wget is available on the target but TCP reverse shells are blocked, download a script from your HTTP server and execute it. This also works for staging larger payloads when the injection character limit is tight.

Blind Command Injection to Interactive

When no output is reflected in the response and outbound connectivity exists, skip the enumeration phase and send a reverse shell directly. If you are unsure which interpreters exist, try each shell one-liner in sequence until a connection arrives on your listener.

When you have blind injection but no outbound connectivity, use the time-based boolean technique to extract information character by character. Compare each character of the command output against a known value using conditional sleep.

A 5-second delay means the first character of the username is w. Increment the cut -c position to extract subsequent characters. This is tedious manually but scriptable. Another option for blind injection: write command output to a file in the webroot and read it through HTTP.

Upgrading Shells

Raw reverse shells lack tab completion, history, and proper terminal handling. Ctrl+C kills the shell instead of the running process. Upgrade to a fully interactive PTY to fix this. The standard Python PTY upgrade works on any target with Python installed.

After spawning the PTY, background the shell with Ctrl+Z, configure your local terminal, then foreground the shell.

Then set the terminal type and dimensions on the target shell.

This gives you a fully interactive shell with tab completion, arrow keys, and Ctrl+C working as expected. If Python is not available, try script /dev/null -c bash as an alternative PTY spawn. For a more advanced approach, socat provides encrypted and fully interactive reverse shells when installed on both ends.