Let's say there's a site which is vulnerable to user's input.
For example users can ping a specified IP.
Since the site is vulnerable to Os command injection, a user as well as an IP address he/she decides to add the following command:
So actually what he/she inserts is:
; stands for separator to commands in the same line
ls means listing the content of a directory
Of course , what I wrote above is valid if and only if the underlying server operating system is Unix-like.
My question: in case the Os is Windows (Windows Server 2003 or whatever even a more recent version) what an attacker should write after the IP ?
dir the only thing or maybe another more dangerous command?
It's just for study purposes.
Thanks a lot