almost finished with the write-up for the command injection vulnerability
added a tutorial for command injection