What problem does it solve?
Suspected command injection findings based on response differences or timing delays are inconclusive and often disputed. This Skill turns a suspected OS command injection into verified proof of remote code execution by triggering an out-of-band (OAST) callback from the target server, then captures one minimal follow-on demonstration of impact.
Core Features & Use Cases
- Behavioral Confirmation: Sends baseline and metacharacter probes (
;, &&, |, backticks, $()) to detect response differentials indicating a parameter reaches a shell or exec call.
- OAST-Based RCE Proof: Mints a canary and injects OS-appropriate payloads (sh/bash, cmd.exe, PowerShell) that trigger DNS or HTTP callbacks, treating even DNS-only callbacks as valid proof.
- Safe Impact Demonstration: Performs one non-destructive follow-on action such as reading a line of /etc/passwd, dumping environment variables, or capturing hostname/user identity via the callback channel.
- Structured Reporting: Files a critical-severity finding with CWE-78, the exact triggering payload, callback timestamp, and one masked line of leaked data.
- Use Case: During an authorized web application assessment, a
filter= parameter on an image-rendering endpoint responds differently to ;. The Skill confirms execution with a curl-based OAST callback, leaks one line of /etc/passwd as impact evidence, and reports a critical CWE-78 finding.
Quick Start
Verify whether the filter parameter on the /api/render endpoint is vulnerable to OS command injection and prove it with an OAST callback.
