A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Command injection occurs when data crosses into a shell parser as code. The obvious example is `eval`, but `bash -c "$user_input"` and similar constructs create the same boundary. The safe alternative is to keep the command fixed and pass untrusted data as arguments, ideally through arrays.
Even when a command itself supports a filename safely, an intermediate shell can break the guarantee. Consider a web scanner wrapper that receives `--header "X-Test: $value"`; direct array execution keeps the value data. Rebuilding the entire command as one string invites metacharacters such as `;`, `|`, `$()`, or redirection operators to become syntax.
Builds an argument array where the search term and filename remain data. The useful habit here is to treat the command output as evidence about one system fact, not as a magical diagnosis.
The command output shown here is a training fixture description. On a live system, verify the actual output rather than assuming it matches the example.
Input validation still matters after you remove `eval`. A scanner target should be constrained to the authorized lab range. A path should be limited to expected directories. Safe execution and semantic validation are complementary controls.
Demonstrates a safe pattern for passing a value as `$1` to a child Bash command instead of concatenating shell syntax. Read the result in context: the same command can be correct yet insufficient if a permission boundary, alternate configuration, or different backend changes what it reports.
A practitioner’s checkpoint: compare the observed behavior with the assumption your script is about to make. If the assumption is broader than the evidence, narrow the rule. If the evidence is incomplete, report the uncertainty instead of converting it into a confident finding.
Lab discipline: stay inside the declared course environment, prefer read-only checks for learning exercises, and preserve the original output of security tools before transforming it.
Finish the lesson once you have worked through the material. This awards ★ 35 XP.