Hi,

This post is regarding OS Injection.

Injection always possible on user input field only. In OS injection first, we need to determine the Operating System (OS) on which the server running.

So we are running on Windows and the payload varies. For example, on Linux, we use `ls` for listing directory and `dir` in windows. So Extreme Vulnerable Node Application (XVNA) is hosted in windows through which we are going test. Watch the video to see how it is been executed.

Extreme vulnerable node application is available at Github https://github.com/vegabird/xvna and you can download it and test in your localhost.

Solution:

We need to sanitize or ban the input which could cause the vulnerability to occur, those are as follows

• &&
• |
• …