# OS Injection

Operating system command injection is similar to the other injection attacks we’ve covered in this chapter, but instead of, say, database queries, you’ll inject a command separator and operating system commands. When you’re performing operating system injection, it helps a great deal to know which operating system is running on the target server. Make sure you get the most out of your Nmap scans during reconnaissance in an attempt to glean this information.

As with all other injection attacks, you’ll begin by finding a potential injection point. Operating system command injection typically requires being able to leverage system commands that the application has access to or escaping the application altogether. Some key places to target include URL query strings, request parameters, and headers, as well as any request that has thrown unique or verbose errors (especially those containing any operating system information) during fuzzing attempts.

Characters such as the following all act as command separators, which enable a program to pair multiple commands together on a single line. If a web application is vulnerable, it would allow an attacker to add command separators to existing command and then follow it with additional operating system commands:

* `|`
* `||`
* `&`
* `&&`
* `'`
* `"`
* `;`
* `'"`

If you don’t know a target’s underlying operating system, put your API fuzzing skills to work by using two payload positions: one for the command separator followed by a second for the operating system command. The table below is a small list of potential operating system commands to use.

## Common Operating System Commands to Use in Injection Attacks

| Operating System       | Command                                                                                                                                                                                                                                                                                                                                                                                            |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Windows                | <ul><li><strong><code>ipconfig</code></strong> shows the network configuration.</li><li><strong><code>dir</code></strong> prints the contents of a directory.</li><li><strong><code>ver</code></strong> prints the operating system and version.</li></ul>                                                                                                                                         |
| \*nix (Linux and Unix) | <ul><li><strong><code>whoami</code></strong> prints the current user.</li><li><strong><code>ifconfig</code></strong> shows the network configuration.</li><li><strong><code>ls</code></strong> prints the contents of a directory.</li><li><strong><code>pwd</code></strong> prints the current working directory.</li><li><strong><code>whoami</code></strong> prints the current user.</li></ul> |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://davidjosearaujo.gitbook.io/online-courses/api-penetration-testing-course/injection-vulnerabilities/discovering-injection-vulnerabilities/os-injection.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.