new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

injection/os_command

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

OS command injection attack vector

OS command injection is performed by appending a semicolon followed by an operating system command to URL query parameters. The semicolon (URL encoded as %3B) is interpreted as a command separator. Example: http://sensitive/something.php?dir=%3Bcat%20/etc/passwd executes both the original command and cat /etc/passwd.

OS command injection testing during code review

During code review, check if command execute methods are called with unvalidated user input as data for the command. Static Code Analysis tools can check the data flow of untrusted user input and verify if it enters a dangerous method that executes user input as a command.

OS command injection remediation: Parameterization

If it is unavoidable to call system commands with user-supplied input, use parameterization as the first defense layer. Use structured mechanisms that automatically enforce separation between data and command, providing relevant quoting and encoding.

OS command injection remediation: Input validation

For OS command injection prevention, both commands and their arguments must be validated. Commands must be validated against a list of allowed commands. Arguments should be validated using positive allowlist input validation (explicitly defined allowed arguments) or allow-list regular expression (explicitly defined good characters with maximum length). Metacharacters like & | ; $ > < \ \ ! and whitespaces must not be part of validation. Example regex allowing only lowercase letters and numbers, 3-10 characters: ^[a-z0-9]{3,10}$

Java ProcessBuilder correct usage - separate command and arguments

Correct: ProcessBuilder pb = new ProcessBuilder("TrustedCmd", "TrustedArg1", "TrustedArg2"); Map<String, String> env = pb.environment(); pb.directory(new File("TrustedDir")); Process p = pb.start(); The command and each argument are passed separately, making it easy to validate each term and reducing the risk of injecting malicious strings.

Give your agent this brain