os command injection

OS command injection happens when an application passes user input to a shell without proper escaping. A semicolon, backtick, $(), or pipe is enough to break out of the intended command and execute arbitrary code with the application's privileges.

The labs cover blind and non-blind injection, time-based extraction, out-of-band exfiltration, filter bypasses (whitespace, blacklist evasion, character substitution), and post-exploitation patterns: reverse shells, file read, and pivoting from a webshell to a stable shell.