Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

Command Injection

OS command injection turns a harmless-looking parameter into a shell prompt for an attacker. Here is how shell metacharacters escape into system commands, the blind variants, and the fix that ends it.

3 articles 17 min total Overview to advanced techniques

Start with the overview

Command Injection7 min read

Command Injection: How One Semicolon Hands Over Your Server

OS command injection turns a harmless-looking parameter into a shell prompt for an attacker. Here is how shell metacharacters escape into system commands, the blind variants, and the fix that ends it.

Read the overview

Command Injection techniques

2 focused deep-dives
  1. 02 Argument InjectionArgument Injection: Hijacking a Command Without a Shell 5 min
  2. 03 BlindBlind Command Injection: Proving Execution Through Time and DNS 5 min