Lab · Intermediate · 20 min Solved
Command injection (fake ping)
A pretend ping panel builds a shell line from your host. Chain another command. No real shell runs.
1) The idea
If your text is pasted into a shell command, characters like ; start a second command.
2) Try it
Ping a host, then chain cat /flag.
Hint 1
End the first command, then start another.
Hint 2
example.com; cat /flag
3) The fix
Do not call a shell. Use APIs that take argument lists. Strict allow-list for hostnames. Drop privileges. Prefer libraries that ping without /bin/sh.
Simulated tools. They can only act on this lab's fake target inside the sandbox — there is no target field, no network, and nothing leaves your browser.
Command-injection fuzzerTries shell separators on the fake ping panel. No real shell exists.
$ cmdi-sim --sep ';,&&,|'
Recon (headers & forms)Lists the fake target's simulated headers and input fields.
$ recon-sim
Real scanners against real sites without permission are illegal. Use these ideas only on systems you own or are authorized to test.