What it is

Command injection occurs when user input reaches a shell command unsanitised. Shell metacharacters (; | & `$()`) let the attacker append or substitute their own commands, running with the privileges of the application process.

How to test for it

Append command separators and benign commands, watching for changed output or timing. For blind cases, trigger out-of-band DNS or HTTP callbacks, and use encoding and whitespace tricks to bypass weak input filters.

How to prevent it

Avoid invoking a shell at all — call binaries directly with an argument array and no shell interpretation. If a shell is unavoidable, use strict allow-list validation and never interpolate raw user input into the command string.