cmd-injection

Name: cmd-injection
Availability: InStock
Author: SecurityforTech

Detect and exploit OS command injection vulnerabilities using shell metacharacters and time-delay payloads.

6|1|Updated Mar 9, 2026

Search Tags:#vulnerability #injection #web security #command injection #pentesting #os command

Ready to run

npx skills add https://github.com/securityfortech/hacking-skills --skill cmd-injection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cmd-injection
Source: https://github.com/securityfortech/hacking-skills/tree/main/skills/web/injection/cmd-injection
Command: npx skills add https://github.com/securityfortech/hacking-skills --skill cmd-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, commix, burp-suite, owasp-zap, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and exploit vulnerabilities where user input is passed unsanitized to a system shell, allowing attackers to execute arbitrary commands on the server.

Core Features & Use Cases

Vulnerability Detection: Identifies parameters susceptible to command injection by testing shell metacharacters and time-delay payloads.
Exploitation: Provides methods for data exfiltration and command execution in blind injection scenarios.
Use Case: A pentester can use this skill to confirm if a web application parameter that accepts hostnames is vulnerable to command injection, and then attempt to read sensitive files like /etc/passwd.

Quick Start

Use the cmd-injection skill to test the parameter 'host' on the target URL 'http://example.com/ping' for command injection vulnerabilities.

Frequently Asked Questions about cmd-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test web application parameters for OS command injection vulnerabilities?▼

Detect OS command injection by injecting shell metacharacters and time-delay payloads into web application parameters to identify unsanitized system shell execution. This approach scans for dangerous API usage across Java, Python, PHP, and C.

How do I exploit blind command injection to exfiltrate server data?▼

Exploit blind command injection using time-delay payloads and data exfiltration techniques to confirm arbitrary command execution on the server. This allows attackers to extract sensitive files like /etc/passwd from vulnerable hostname parameters.

Do I need Burp Suite and Commix to perform command injection pentesting?▼

Comprehensive command injection pentesting requires tools like curl, Commix, Burp Suite, and OWASP ZAP. These dependencies provide the necessary HTTP traffic manipulation and automated exploitation capabilities for thorough vulnerability testing.

What is the best way to detect dangerous API usage for shell execution in PHP and Python?▼

Detect dangerous API usage for shell execution in PHP and Python by scanning parameters for shell metacharacters and testing time-delay payloads. This identifies application code passing unsanitized user input directly to system shells.

Why is my command injection payload not executing on the target server?▼

Command injection payloads may fail if the target application sanitizes shell metacharacters or uses safe API alternatives instead of direct system shell calls. Testing with time-delay payloads helps confirm if the parameter is actually vulnerable to execution.