I'm looking for a demonstration web site that shows an example of a web site that is vulnerable to command injection: where I can inject something and get the web site to run a shell command. (This is solely for demonstration purposes, to help teach others about the dangers of command injection.) Does anyone know of any demonstration web site like this?

If the location of the command injection vulnerability is not documented publicly, please describe where the command injection vulnerability is (e.g., the page and parameter that is vulnerable). I'm not looking for a puzzle to learn how to perform command injection attacks; I'm already familiar with it. Instead, I'm looking for an example that I can use to show the problem to others.

closed as off-topic by techraf, S.L. Barth - Reinstate Monica, Steve, CaffeineAddiction, J.A.K. Feb 23 '17 at 9:08

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Download webgoat... stay off the network when running the webgoat on your machine.. There is dedicated lesson on command injection under injection attacks. Use the hints if you don't want to spend time on figuring out how to solve the lesson – Sachin Kumar Apr 11 '12 at 9:04

The WebGoat Project has a lesson specifically on command injection ;)


Try Hack This Site. It has examples, in the form of "puzzles," of a number of vulnerabilities.

  • Can you tell me which "missions" on Hack This Site demonstrates a shell command injection vulnerability? There are a lot of missions there. (Also, are there any "missions" that demonstrate this flaw with a realistic-looking site?) – D.W. Apr 11 '12 at 7:33
  • Update: basic7 seems to be an example of shell command injection, though the web site provides only super-limited emulation of the behavior of a vulnerable app and is a non-realistic example. realistic11 has a command injection and is a realistic-looking website, but it provides super-limited emulation of the command injection vulnerability which prevents exploiting it in the most natural ways (e.g., providing any command to run on the server other than ls). – D.W. Apr 11 '12 at 7:49

this vulnerable web application will help you understand OWASP top 10 and you can find command injection vulnerable pages in it , try them and here is the link mutillidae


Download iso file from links below. There are good exercises.

Web For Pentester : https://www.pentesterlab.com/exercises/web_for_pentester

Web For Pentester II : https://pentesterlab.com/exercises/web_for_pentester_II

Not the answer you're looking for? Browse other questions tagged or ask your own question.