Command Injection

What Is Command Injection?

Command injection turns one web request into code execution under the server's own identity. The application pastes user input into a command string and hands it to a shell, which reads every special character as syntax. You'll add a semicolon to the host field of a network diagnostics tool, run a second command, and read back the environment file with the database password in it. Then you replace the concatenated string with execFile so the host stays a single argument, and see why filtering dangerous characters always loses.

What You'll Learn in Command Injection

• Identify the shell-out pattern: any user input pasted into a command string that is passed to a shell (exec, system, sh -c) is a command injection candidate
• Recognize how a shell separator like a semicolon turns one command into two when input is not kept out of the shell
• Apply the argument-list fix: execFile or spawn with an argument array so the program runs directly and shell characters in the input stay literal
• Understand why filtering characters like ; and | fails (other separators, encodings, and substitutions bypass it)
• Reduce blast radius with least privilege and by keeping secrets out of files a worker can read

Command Injection — Training Steps

1. The diagnostics tool

   Trelvane runs a hosting platform, and it offers a public Looking Glass: paste a host, and Trelvane's edge servers ping it for you and hand back the raw output. Handy for customers checking whether a server is reachable. Bob opens it to see how it behaves before he touches it.

2. It runs a real command

   One line on that page is the whole reason Bob is interested.

3. Use the feature

   Watch the tool behave normally. Ping an ordinary host so the browser captures the request the page sends.

4. Find the request

   The request went out and the browser recorded it. Open the Network panel and read where the page sent it and how the host travels.

5. Inject a second command

   Bob never touches the form again. He edits the captured request in the Network panel and rewrites the host value: a loopback address, a semicolon, then two commands of his own. If the server builds its ping command by pasting the value in, the semicolon ends the ping and Bob's commands run right after it. He chains id to see who the server runs as and a cat of the worker's environment file, where hosting agents keep their database password and cloud keys.

6. The keys are gone

   The ping ran, and then lines appear that ping never produces.

7. Knowledge check

   You just watched a ping tool run the attacker's commands and leak the server's secrets. Lock in why.

8. The alert

   You own Trelvane's Looking Glass service. Overnight, monitoring flagged the diagnostics worker doing something a ping tool should never do: running shell commands and reading its own secrets file. Security Operations has emailed you the details.

9. Open the handler

   The ping endpoint is served by ping.js . Open it and look at how it runs the command.

10. Spot the flaw

    The handler pastes the host value into a command string and hands the whole string to a shell to run.