OS Command Injection

Cross-platform resources for OS Command Injection: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice OS Command Injection: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 27 challenges across 3 platforms — 17 HackTheBox · 5 PortSwigger · 5 TryHackMe. 17 with a Spanish writeup, 17 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — OS command injection, simple case (Apprentice) · 🇬🇧
2. TryHackMe — Advent of Cyber 2022 (Easy · ~1440 min) · 🇬🇧
3. TryHackMe — Avengers Blog (Easy · ~30 min) · 🇬🇧
4. TryHackMe — Command Injection (Easy · ~20 min) · 🇬🇧
5. HackTheBox — Doctor (Fácil) · 🇪🇸 🇬🇧 📹
6. HackTheBox — Netmon (Fácil) · 🇪🇸 🇬🇧 📹

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/os-command-injection

HTB machines practicing OS Command Injection (17)

Machine	OS	Difficulty	Writeup
Anubis	Windows	INSANE	🇪🇸 🇬🇧 📹
Cronos	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Doctor	Linux	EASY	🇪🇸 🇬🇧 📹
FluxCapacitor	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Fortune	Linux	INSANE	🇪🇸 🇬🇧 📹
Haircut	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Netmon	Windows	EASY	🇪🇸 🇬🇧 📹
Nightmare	Linux	INSANE	🇪🇸 🇬🇧 📹
Node	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Noter	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Obscurity	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Player	Linux	HARD	🇪🇸 🇬🇧 📹
RouterSpace	Linux	EASY	🇪🇸 🇬🇧 📹
ScriptKiddie	Linux	EASY	🇪🇸 🇬🇧 📹
Union	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Unobtainium	Linux	HARD	🇪🇸 🇬🇧 📹
Writer	Linux	MEDIUM	🇪🇸 🇬🇧 📹

PortSwigger labs practicing OS Command Injection (5)

Lab	Difficulty	Topic	Official
OS command injection, simple case	APPRENTICE	OS Command Injection	Open
Blind OS command injection with out-of-band data exfiltration	PRACTITIONER	OS Command Injection	Open
Blind OS command injection with out-of-band interaction	PRACTITIONER	OS Command Injection	Open
Blind OS command injection with output redirection	PRACTITIONER	OS Command Injection	Open
Blind OS command injection with time delays	PRACTITIONER	OS Command Injection	Open

TryHackMe rooms practicing OS Command Injection (5)

Room	Difficulty	Type	Access	Official
Advent of Cyber 2022	EASY	Walkthrough	🟢 Free	Open
Avengers Blog	EASY	Walkthrough	🔵 VIP	Open
Command Injection	EASY	Walkthrough	🔵 VIP	Open
Web Attack Forensics - Drone Alone	MEDIUM	Walkthrough	🟢 Free	Open
envizon	HARD	Challenge	🟢 Free	Open

Related skills

• /en/skills/rce

---

← Back to the full glossary

Last updated: 2026-08-17