Command Injection Sandbox
A "ping this host" tool glues your input into a real shell command. Chain a second command onto the intended one.
A "ping this host" feature that builds a shell command by pasting your input into a string. Add a shell metacharacter and your second command runs alongside the first — with whatever privileges the web process holds.
How to use it
- Ping a normal hostname.
- Append a shell separator such as ; or &&.
- Run a command the feature never intended.
What to take away
The shell is the problem
Invoking a command through a shell means metacharacters are interpreted. Passing an argument array directly to the process avoids the shell entirely.
Blind command injection is common
When output is not returned, attackers confirm execution with timing — sleep 10 — or an outbound network callback.
Frequently asked questions
How is command injection fixed?
Do not build shell strings from input. Use APIs that take an argument array, avoid shell invocation, and where a value must be user-supplied, allowlist its format strictly.
Which characters matter?
; && || | & newline, plus $() and backticks for substitution. Any one of them can extend the intended command.
Where this fits in the course
This security lab pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- SQL Injection Sandbox — A fake login backed by a simulated database. Watch your input become SQL, then bypass the login with a classic injection.
- Path Traversal Playground — A fake "view file" feature that trusts the filename you give it. Climb out of the intended folder with ../ and read files you shouldn't.
- Linux Privesc Playground — Enumerate SUID binaries on a simulated box and find the one GTFOBins turns straight into a root shell.
- Secure Code Review Toy — Paste a code snippet and get flagged patterns — eval, string-built SQL, hardcoded secrets. Not a real SAST tool, but trains the eye.