Command Injection is very simple, you just exploit it by executing commands on a web page because it allows you to do so. In other words, if you ever see a page that offers the functionality of executing a command in the backend, then it's probably vulnerable to this attack. Command Injection is very popular in Capture the Flag (CTF) because it allows you to completely own a remote machine (the machine that hosts the web application).
As usual, let's see a practical example using Mutillidae. Open the left menu OWASP 2017 | Injection | Command Injection | DNS Lookup:
This page executes the DNS Lookup command in the backend. In this example, I entered the IP address 10.0.0.1 and clicked on the Lookup DNS button.
Do you think we can override the normal behavior of this page and execute any command of our liking? (Or maybe execute a backdoor such as netcat...
