What problem does it solve?
Web applications that pass user input to system shells are vulnerable to arbitrary command execution, but testers often miss these flaws by trying only one separator or skipping blind detection. This Skill provides a systematic methodology to find, confirm, and safely demonstrate OS command injection during authorized penetration tests.
Core Features & Use Cases
- Full separator matrix testing: Covers
;, |, &&, backticks, $(), newline injection, and IFS/brace bypasses for filtered inputs across Linux and Windows targets.
- Blind and out-of-band confirmation: Uses timing-based probes (
sleep) and OOB DNS/HTTP callbacks via interactsh or Burp Collaborator when no output is reflected.
- Safe proof-of-concept guidance: Restricts PoC to read-only commands like
id and whoami, with a structured finding report format including CVSS, OWASP mapping, and remediation advice.
- Use Case: While testing a "ping host" diagnostic page, you submit
127.0.0.1;id, observe uid=33(www-data) in the response, confirm blind variants with a 10-second sleep, and document a Critical command injection finding.
Quick Start
Ask the agent to test the target's diagnostic ping parameter for OS command injection using the full separator matrix and confirm any blind hits with timing and out-of-band callbacks.
