Testing for command injection

Command injection is a vulnerability that enables an attacker to execute commands on the application’s underlying operating system (the host). This vulnerability occurs when the application takes unsanitized and unvalidated user input and executes it in a system command. Some examples of system commands are grep, exec, and system. The system commands differ depending on the programming language that the application is developed with. Usually, to perform the command injection attack, you provide the application with the expected input and then a special character to execute the desired commands right after the expected input (command). Special characters, such as |, &, ;, |, ||, &, &&, and \n append more commands to the executed command. Using these special characters, you can execute more commands at the same time. The severity of the vulnerability is determined by the permissions granted to the application’s user account...