command-injection

What problem does it solve?

This Skill helps penetration testers identify and exploit vulnerabilities where user input is passed unsafely to an operating system shell, enabling arbitrary command execution.

Core Features & Use Cases

• OS Command Injection Exploitation: Guides users through identifying and exploiting command injection flaws in web applications.
• Payload Generation: Provides a comprehensive list of operators and bypass techniques for various injection scenarios (Linux/Windows, quoted/unquoted, space/character filters).
• Blind Injection Handling: Offers strategies for time-based and out-of-band (OOB) data exfiltration when command output is not directly visible.
• Use Case: A penetration tester discovers a parameter in a web application that seems to accept shell commands. They use this Skill to test for injection, bypass filters, and ultimately execute commands like id or whoami on the target server.

Quick Start

Use the command-injection skill to test for OS command injection in the 'ip' parameter of the URL 'http://example.com/ping?ip=127.0.0.1'.