The prerequisite for an OS command injection vulnerability to exist is that server-side, the application
makes calls to the operating system through libraries, DLLs, components or functions.
Such calls to the operating system become vulnerable if they involve passing invalid input
arguments.
The slide shows a possible example of server-side invocation of a script (which makes calls
to the operating system) to which parameters, depend on user input, are passed.
Malicious inputs could, for example, be executed by server side functions such as the C++ system()
function or the PHP exec() function.
Attackers may also make use of shell operators such as the pipe operator or the ampersand operator to
exploit more efficiently the vulnerability from OS command injection.
To test the presence of the vulnerability in black box mode, you can try to inject malicious inputs as
a ping command that create a delay in the response of the web application.
So if there is actually a delay, it means that the application is vulnerable.
Remedies for OS command injection, are to avoid calling OS commands directly.
And if the use of OS commands is unavoidable, make sure to validate the inputs from the requests
to only a white list of possible values by discarding the rest.
Furthermore, calls to system functions should be made with the least possible privileges.
Thank you for your kind attention.