OS Command Injection
Found any parameter which fetches for data like "siteID=1", in the HTTP response body then tamper it using :
Check the feedback form for any Blind OS injection, tamper the email section with the ping command :
Check for any out-of-band network interaction using the Burp collaborator client tab / ngrok
Meta Characters for OS injections attacks, Both for UNIX and Windows :
Note
Sometimes, the input that you control appears within quotation marks in the original command. In this situation, you need to terminate the quoted context (using " or ') before using suitable shell metacharacters to inject a new command.
While submitting a file or uploading it to check for file-upload vulnerabilities, Do tamper the filename parameter for any blind injections
Found any search parameter on the domain page, do not hesitate to :
Common parameters for testing :
To automate all this, We have a best automation tool to detect command injection vulns :
Last updated
