Command Injection

Check List

Methodology

Black Box

Reflected Command Injection In an Embedded Cloud Shell

1

When a web application includes a terminal, shell, or IDE interface (e.g., Cloud Shell, Dev Console, Admin Terminal), test URL parameters (project, env, config) for command injection.

2

Access the cloud console or developer environment and identify a terminal or shell interface (via ?show=ide,terminal, ?mode=console, or a "Terminal" tab)

3

Locate a configurable parameter (project, env, workspace, config) in the URL that influences the terminal session or backend configuration and Change ?project=test and observe the terminal prompt or project name update

4

Switch to a minimal or IDE-only view (show=ide, view=code) where the parameter is likely processed in a script (Python, Node.js, etc.)

5

inject a single quote (') into the parameter and reload; if a script syntax error appears in the terminal (SyntaxError, unexpected token), it confirms direct reflection without encoding

6

Use syntax closure to neutralize the original code

• If reflection is in if 'value':, close with ':# to comment out the rest

• If multi-line, use triple quotes: '''; to close strings. Set project=asd':# or project=asd''';print('' to fix syntax and gain control

7

inject project=asd''';import os;os.system("id");print('' , Reload and check terminal output for uid=....

---

Language Parameter

1

Log in to the target site

2

Then use the burp suite tool to inspect the requests and identify the endpoints

3

Then, check in the identified endpoints whether there is a parameter called language= or a parameter that specifies the language

4

Then send the request to the repeater and replace the language parameter value with the following content and if the send method was GET, change it to POST

{${system("cat+/etc/passwd"J)}}

5

Send the request and then check whether the server's response shows the sensitive file content

---

White Box

Cheat Sheet