OS Command Injection: When User Input Reaches a Shell

What it is#

Whenever user input is concatenated into a string that gets handed to a shell, an attacker can often append a second command of their own, using the shell's own metacharacters.

The labs here#

• PingPoint uptime checker injection: the direct version. A host field is concatenated straight into a ping -c 1 <input> shell command. A semicolon, backtick, or $() gets you a second command running alongside (or instead of) the intended one.
• ArchiveIt tar wildcard injection: no shell metacharacters needed at all here. The folder name itself is properly escaped, but filenames inside that folder aren't, and the backup command runs tar czf backup.tar.gz *. Create a file whose name looks like a tar option (for example one starting with --checkpoint-action=), and the wildcard expansion hands it to tar as an argument instead of a filename, which is enough to run an arbitrary command.