Command Injection

What Is Command Injection?

Command injection is one of the highest-impact vulnerabilities in the OWASP catalog because it turns a single web request into arbitrary command execution under the server's identity. The bug pattern is universal: the application builds a command string by pasting user input into it, then hands the whole string to a shell to run. Every special character in the user-controlled portion is interpreted by the shell as command syntax. This exercise puts you on both sides of a real exploit at Trelvane, a hosting provider whose public Looking Glass tool pings a host for you from its edge network. As Bob, an attacker, you notice the tool runs a real ping command with the host you supply, capture the request the page sends, and edit it in the browser's network tools so the host value carries a semicolon followed by id and a cat of the worker's environment file. All three commands run on the server and you walk away with its database password and cloud keys. As Alice, the platform security engineer, you arrive from a security alert, open the vulnerable handler, and ship the fix: replace the shell command string with an execFile call that passes the host as a single argument, so no shell is involved and a semicolon in the value is just a character in a hostname.

What You'll Learn in Command Injection

• Identify the shell-out pattern: any user input pasted into a command string that is passed to a shell (exec, system, sh -c) is a command injection candidate
• Recognize how a shell separator like a semicolon turns one command into two when input is not kept out of the shell
• Apply the argument-list fix: execFile or spawn with an argument array so the program runs directly and shell characters in the input stay literal
• Understand why filtering characters like ; and | fails (other separators, encodings, and substitutions bypass it)
• Reduce blast radius with least privilege and by keeping secrets out of files a worker can read

Command Injection — Training Steps

1. The diagnostics tool

   Trelvane runs a hosting platform, and it offers a public Looking Glass: paste a host, and Trelvane's edge servers ping it for you and hand back the raw output. Handy for customers checking whether a server is reachable. Bob opens it to see how it behaves before he touches it.

2. It runs a real command

   One line on that page is the whole reason Bob is interested.

3. Use the feature

   Watch the tool behave normally. Ping an ordinary host so the browser captures the request the page sends.

4. Find the request

   The request went out and the browser recorded it. Open the Network panel and read where the page sent it and how the host travels.

5. Inject a second command

   Bob never touches the form again. He edits the captured request in the Network panel and rewrites the host value: a loopback address, a semicolon, then two commands of his own. If the server builds its ping command by pasting the value in, the semicolon ends the ping and Bob's commands run right after it. He chains id to see who the server runs as and a cat of the worker's environment file, where hosting agents keep their database password and cloud keys.

6. The keys are gone

   The ping ran, and then lines appear that ping never produces.

7. Knowledge check

   You just watched a ping tool run the attacker's commands and leak the server's secrets. Lock in why.

8. The alert

   You own Trelvane's Looking Glass service. Overnight, monitoring flagged the diagnostics worker doing something a ping tool should never do: running shell commands and reading its own secrets file. Security Operations has emailed you the details.

9. Open the handler

   The ping endpoint is served by ping.js . Open it and look at how it runs the command.

10. Spot the flaw

    The handler pastes the host value into a command string and hands the whole string to a shell to run.