pentest-command-injection

Identifies and exploits command injection and remote code execution vulnerabilities in web applications.

74|10|Updated Mar 5, 2026

Search Tags:#penetration testing #command injection #deserialization #rce #vulnerability exploitation #log4shell

Ready to run

npx skills add https://github.com/yhy0/ghsa-skill-builder --skill pentest-command-injection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pentest-command-injection
Source: https://github.com/yhy0/ghsa-skill-builder/tree/main/vuln-skills/skills/pentest-command-injection
Command: npx skills add https://github.com/yhy0/ghsa-skill-builder --skill pentest-command-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps security professionals identify and exploit command injection and remote code execution vulnerabilities in web applications, streamlining penetration testing efforts.

Core Features & Use Cases

Attack Surface Discovery: Identifies high-risk functionalities and recognition signals for command injection.
Exploitation Techniques: Provides methods for shell meta-character injection, blind injection, deserialization attacks, SSTI, PowerShell injection, Log4Shell, and default credential chaining.
Use Case: During a penetration test, use this Skill to systematically test for OS command injection by injecting shell meta-characters into parameters of network tools or file processing functions.

Quick Start

Use the pentest-command-injection skill to test for OS command injection by injecting shell meta-characters into the 'ping' command parameter.

Frequently Asked Questions about pentest-command-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for OS command injection vulnerabilities in web applications?▼

To test for OS command injection, inject shell meta-characters into input parameters of network tools or file processing functions to evaluate if arbitrary commands execute. This Skill provides systematic detection checklists and exploitation techniques for such scenarios.

What is the best way to exploit blind command injection and remote code execution?▼

Exploiting blind command injection and remote code execution involves using specific shell meta-character injection methods and deserialization attacks. This Skill details these exploitation techniques alongside real-world impact assessments for various frameworks.

How does Log4Shell vulnerability exploitation work during penetration testing?▼

Log4Shell vulnerability exploitation works by leveraging deserialization flaws to achieve remote code execution. This Skill provides detailed exploitation techniques and impact assessments based on real-world cases for testing this specific vulnerability.

Can I use this for SSTI and PowerShell injection testing across different platforms?▼

Yes, you can use this to test for SSTI and PowerShell injection across various platforms and frameworks. It identifies high-risk functionalities and provides specific exploitation methods tailored to these attack vectors.

What are the limitations when testing deserialization attacks for command injection?▼

Testing deserialization attacks for command injection requires recognizing specific high-risk functionalities and signals. This Skill focuses on providing detection checklists and exploitation techniques but does not bypass platform-specific security restrictions.

Why do I need a systematic checklist for command injection vulnerability identification?▼

You need a systematic checklist for command injection identification to accurately pinpoint high-risk functionalities and recognition signals. This Skill streamlines penetration testing by providing detailed detection methods and impact assessments based on real-world cases.