What is command injection?¶

The practical answer¶

Command injection is an attempt to make a web application or service execute operating-system commands through attacker-controlled input.

The key evidential caution¶

The dangerous assumption is that command-like text in a request proves the server ran it.

It may not.

The application may reject, escape, sanitise or ignore the input.

If successful, command injection may allow an offender to:

Key points¶

• run system commands
• read or alter files
• create accounts
• download malware
• open remote access
• move further into the environment

Evidence to preserve¶

Investigators should preserve:

Key points¶

• the exact request
• application and web-server logs
• the process launched
• parent and child processes
• account context
• command line
• file or configuration changes
• network connections
• resulting output where available

A suspicious request demonstrates an attempt or method.

Successful exploitation normally requires server-side process or effect evidence.

Evidential limits¶

Do not assume the web-server account had full administrative privilege.

The command may execute with limited rights or fail entirely.

Likewise, an application error does not prove command execution.

The command may execute under the web application’s service account, container identity or cloud role. Preserve that privilege context because it determines what the command could reach. A successful command does not automatically mean full server or network control.

Where command output is returned through the application, preserve it alongside local process evidence. Output can support successful execution, but should still be linked to the target host and account context. If commands are blind, resulting file, network or process activity may provide the stronger proof.

Operational takeaway¶

Link the malicious input to server-side process execution and resulting effect, and distinguish attempted command injection from successful operating-system access.