🧪 Labs › Injection
OS Command Injection
Severity: High
A feature that shells out to a system command, with your input in the command line.
What it is
Command injection happens when an app builds a shell command from user input — a diagnostics tool that pings a host you supply, an export that calls a converter, a filename passed to a system utility — and the shell parses your input as extra commands.
Shell metacharacters (; | & newlines, command substitution) let you append or substitute commands that run with the app's privileges.
The impact is immediate code execution on the server; it's one of the most severe web bugs.
How to approach it
- Find a feature that likely runs a system command on your input — network tools, file conversion, anything that names an external program.
- Probe how your input is handled: does appending a shell separator change the behaviour or timing?
- When output isn't shown, use timing or an out-of-band signal to confirm execution.
- Reason about any filtering in the way and whether it covers every path to the shell.
Your task
Get the diagnostics feature to run a command of your choosing on the server.
▶ Access the labOpens your hosted RatCTF instance. Work on it directly — there's nothing to submit here; you'll know when you've solved it.
How to prevent it
- Don't call a shell with user input — use APIs that pass arguments as a list, never a command string.
- If a shell is unavoidable, allowlist the exact inputs and escape rigorously.
- Run the component with the least privilege it needs.
More Injection labs
- SQL Injection — Make the database answer a question the application never meant to ask.
- Server-Side Template Injection (SSTI) — When user input becomes part of a server template, the template engine runs it.
- XML External Entities (XXE) — A permissive XML parser can be told to fetch files and URLs for you.
- Insecure Deserialization — Turning attacker-controlled bytes back into live objects can run attacker code.