After completing the OS Command Injection level on High, I was delving a little deeper so I could write it up. It seems that while the solution works on the web app the same command errors on the linux terminal.

DVWA command for the High level|  |cat /etc/passwd

This works. Doesn't output the ping result but prints to screen the contents of /etc/passwd

If I use the exact same command on my linux terminal it errors. Code used to mimic the web application

ping -c 3|  |cat /etc/passwd

I receive the error

bash: syntax error near unexpected token `|'

If I remove the spaces the command works as expected. I can't explain why the shell_exec PHP command passes the command to the OS, the OS runs it and displays the result, yet the direct approach errors. Technically the DVWA command shouldn't work?

  • Unrelated to your question, but /etc/passwd is generally considered public information on a Linux system, as one of its purposes is to map from numeric user IDs to plain-text usernames (useful for example in file listings).
    – user
    Jan 26, 2017 at 15:41

2 Answers 2


It's caused by the deliberately faulty blacklist. Pipe followed by space gets replaced with an empty string. The second pipe is immediately followed by a c and thus does not match the blacklist and hence slips through. The first pipe and space are redundant. Ip|cat should also work, as does ip%0acat and ip%26%26cat.


DVWA Command Injection Hign file in Blacklist

// Set blacklist $substitutions = array( '&' => '', ';' => '', '| ' => '', '-' => '', '$' => '', '(' => '', ')' => '', '`' => '', '||' => '', );

  • This is "&&" not in blacklist.

  • This is using "&&"; ping -c4 && echo "Ok!"

  • That command doesn't work on version 1.10. Only the double pipes with two spaces works it seems.
    – Paulst30
    Jan 31, 2017 at 14:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .