How to Confirm a Command Injection Vulnerability in a Blackbox Test

You are staring at a web form that says "Enter IP address to check host status." No source code. No documentation. Just a text field and a Check button. Your spidey sense says this hits a ping command on the backend. Here is how you confirm it in three steps.

Step one: establish the baseline

The output tells you the backend is running ping -c 1 against your input. One packet transmitted. Standard Linux ping output. The command is almost certainly ping -c 1 <YOUR_INPUT>. Now you know the exact command template.

Step two: inject a benign second command

Append a semicolon and a harmless command. If the response changes to include output from your injected command, the input is not sanitized. Use whoami or id because they produce short, unmistakable output.

There it is. www-data at the bottom of the response. The ping output is the intended command. The www-data line is your injected whoami. The application just confirmed it passes your input directly to a shell. Vulnerability confirmed.

Step three: verify with a second operator

Good practice says confirm with a different operator to rule out false positives. Try the AND operator or a newline character. If both produce injected output, you are not dealing with a fluke or a quirky parser.

Detection is confirmed. But what if the application rejects your payload before it ever reaches the backend? That is exactly what happens when developers add front-end validation. Next lesson covers the operators you need, and the one after that shows you how to bypass client-side checks entirely.