A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
During a whitebox assessment or a code review, you do not have time to read every line. You need pattern recognition. Certain function calls combined with user input are almost always vulnerable. Train your eyes to flag them instantly.
// All of these execute OS commandssystem($cmd);exec($cmd, $output);shell_exec($cmd);passthru($cmd);popen($cmd, 'r');proc_open($cmd, $descriptors, $pipes);// Vulnerable pattern: user input concatenated$ip = $_GET['host'];system("ping -c 1 " . $ip);
const { exec, spawn, execSync } = require('child_process');// Vulnerable: template literal with user inputexec(`nslookup ${req.query.domain}`);// Also vulnerable: string concatenationspawn('ping', ['-c', '1', req.body.host]); // spawn with array is saferexec('ping -c 1 ' + req.body.host); // concatenation is NOT safe
Notice that spawn with an argument array does not invoke a shell by default, making it safer. But exec always spawns a shell. If you see exec with string concatenation or template literals containing request parameters, flag it immediately.
import os, subprocess# Vulnerable patternsos.system(f"ping -c 1 {user_input}")os.popen(f"nslookup {user_input}")subprocess.call(f"ping -c 1 {user_input}", shell=True)subprocess.run(f"ping -c 1 {user_input}", shell=True)# Safer: no shell=True, argument listsubprocess.run(['ping', '-c', '1', user_input])
The shell=True parameter in Python subprocess is the equivalent of PHP's system(). It invokes /bin/sh to parse the string. Without it, arguments are passed directly to the executable as an array, preventing metacharacter interpretation. Always check for shell=True during code review.
You can now spot the vulnerability in source code. But in a blackbox engagement, you will not have source. You will have a web form and a hunch. The next module teaches you how to confirm that hunch with a single crafted request.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.