Web Application Hacking (Hands-On)
Command Injection — Concept + Live Lab
Turn a web feature into a shell by injecting OS commands.
Open the interactive lesson & lab →
Command injection occurs when an app passes user input into an operating-system command. Shell metacharacters let you append your own commands — potentially full control of the server.
A 'ping this host' feature might run:
ping -c 1 <user_input>Input like 127.0.0.1; cat /flag makes the shell run two commands: the ping, then your cat. The ; chains them.
Chaining operators to try
- ; — run the next command unconditionally.
- && — run the next command only if the first succeeds.
- | — pipe output; also useful to chain.
- Try: 127.0.0.1; cat /flag or 127.0.0.1; whoami in the lab.