Is there anything in the response which can be used to distinguish if the command injection was successful? At least, is there an expected result for the request? Would worth to check it, and fail_with if at any point the command injection isn't successful.