> For the complete documentation index, see [llms.txt](https://infosecgirls.gitbook.io/infosecgirls-training/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infosecgirls.gitbook.io/infosecgirls-training/appsec/web-application-pentesting/injection/command-injection.md).

# Command Injection in DVNA

## Exercise  - Command Injection - DVNA

**Step 1:** Click on `"A1: Injection" > "Command Injection: Network Connectivity Test"`

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-LWHQt-EMiiOHTuosAKW%2F-LWHQx3mXuJuoL_-yqER%2F01_ci_ping_function.png?generation=1547571287902969\&alt=media)

**Step 2:** On the "Test System Connectivity" page, enter `8.8.8.8` in the Address field and click Enter. Capture the request that is made using Burp Intercept

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-LWHQt-EMiiOHTuosAKW%2F-LWHQx3rbZqPH43zdF7c%2F02_ci_intercept_request.png?generation=1547571292020310\&alt=media)

**Step 4:** Send the intercepted request to Burp Repeater(CTRL+R) and navigate to repeater(CTRL+SHIFT+R)

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-LWHQt-EMiiOHTuosAKW%2F-LWHQx3vjwJcU6bNVp1Q%2F03_ci_repeater_request.png?generation=1547571287941151\&alt=media)

**Step 5:** In the POST request in Repeater, modify the "address" parameter in POST body to `8.8.8.8;ip addr` and forward the request. The OS executes the `ping 8.8.8.8` and the `ip addr` commands and provides the output to the client.

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-LWHQt-EMiiOHTuosAKW%2F-LWHQx3xmYmFjaKlZwWy%2F04_ci_command_exec.png?generation=1547571289218464\&alt=media)