> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.

# OS Command Injection

> Cross-platform resources for OS Command Injection: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

# OS Command Injection

This page aggregates **cross-platform resources to practice OS Command Injection**: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

## Curated resources

| Source      | Link                                                                                                                   |
| ----------- | ---------------------------------------------------------------------------------------------------------------------- |
| PortSwigger | [https://portswigger.net/web-security/os-command-injection](https://portswigger.net/web-security/os-command-injection) |

## HTB machines practicing OS Command Injection (17)

| Machine                                                     | OS      | Difficulty                                           |
| ----------------------------------------------------------- | ------- | ---------------------------------------------------- |
| [Anubis](/en/htb/machines/windows/insano/anubis)            | Windows | <span className="dbadge dbadge-insane">INSANE</span> |
| [Cronos](/en/htb/machines/linux/medio/cronos)               | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Doctor](/en/htb/machines/linux/facil/doctor)               | Linux   | <span className="dbadge dbadge-easy">EASY</span>     |
| [FluxCapacitor](/en/htb/machines/linux/medio/fluxcapacitor) | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Fortune](/en/htb/machines/linux/insano/fortune)            | Linux   | <span className="dbadge dbadge-insane">INSANE</span> |
| [Haircut](/en/htb/machines/linux/medio/haircut)             | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Netmon](/en/htb/machines/windows/facil/netmon)             | Windows | <span className="dbadge dbadge-easy">EASY</span>     |
| [Nightmare](/en/htb/machines/linux/insano/nightmare)        | Linux   | <span className="dbadge dbadge-insane">INSANE</span> |
| [Node](/en/htb/machines/linux/medio/node)                   | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Noter](/en/htb/machines/linux/medio/noter)                 | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Obscurity](/en/htb/machines/linux/medio/obscurity)         | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Player](/en/htb/machines/linux/dificil/player)             | Linux   | <span className="dbadge dbadge-hard">HARD</span>     |
| [RouterSpace](/en/htb/machines/linux/facil/routerspace)     | Linux   | <span className="dbadge dbadge-easy">EASY</span>     |
| [ScriptKiddie](/en/htb/machines/linux/facil/scriptkiddie)   | Linux   | <span className="dbadge dbadge-easy">EASY</span>     |
| [Union](/en/htb/machines/linux/medio/union)                 | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Unobtainium](/en/htb/machines/linux/dificil/unobtainium)   | Linux   | <span className="dbadge dbadge-hard">HARD</span>     |
| [Writer](/en/htb/machines/linux/medio/writer)               | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |

## PortSwigger labs practicing OS Command Injection (5)

| Lab                                                                                                                                            | Difficulty                                                 | Topic                | Official                                                                                                  |
| ---------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | -------------------- | --------------------------------------------------------------------------------------------------------- |
| [OS command injection, simple case](/en/portswigger/labs/os-command-injection/simple)                                                          | <span className="dbadge dbadge-easy">APPRENTICE</span>     | OS Command Injection | [Open](https://portswigger.net/web-security/os-command-injection/lab-simple)                              |
| [Blind OS command injection with out-of-band data exfiltration](/en/portswigger/labs/os-command-injection/blind-out-of-band-data-exfiltration) | <span className="dbadge dbadge-medium">PRACTITIONER</span> | OS Command Injection | [Open](https://portswigger.net/web-security/os-command-injection/lab-blind-out-of-band-data-exfiltration) |
| [Blind OS command injection with out-of-band interaction](/en/portswigger/labs/os-command-injection/blind-out-of-band)                         | <span className="dbadge dbadge-medium">PRACTITIONER</span> | OS Command Injection | [Open](https://portswigger.net/web-security/os-command-injection/lab-blind-out-of-band)                   |
| [Blind OS command injection with output redirection](/en/portswigger/labs/os-command-injection/blind-output-redirection)                       | <span className="dbadge dbadge-medium">PRACTITIONER</span> | OS Command Injection | [Open](https://portswigger.net/web-security/os-command-injection/lab-blind-output-redirection)            |
| [Blind OS command injection with time delays](/en/portswigger/labs/os-command-injection/blind-time-delays)                                     | <span className="dbadge dbadge-medium">PRACTITIONER</span> | OS Command Injection | [Open](https://portswigger.net/web-security/os-command-injection/lab-blind-time-delays)                   |

## TryHackMe rooms practicing OS Command Injection (5)

| Room                                                                                            | Difficulty                                         | Type        | Access  | Official                                                                 |
| ----------------------------------------------------------------------------------------------- | -------------------------------------------------- | ----------- | ------- | ------------------------------------------------------------------------ |
| [Advent of Cyber 2022](/en/tryhackme/rooms/adventofcyber4)                                      | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🟢 Free | [Open](https://tryhackme.com/room/adventofcyber4)                        |
| [Avengers Blog](/en/tryhackme/rooms/avengers)                                                   | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🔵 VIP  | [Open](https://tryhackme.com/room/avengers)                              |
| [Command Injection](/en/tryhackme/rooms/oscommandinjection)                                     | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🔵 VIP  | [Open](https://tryhackme.com/room/oscommandinjection)                    |
| [Web Attack Forensics - Drone Alone](/en/tryhackme/rooms/webattackforensics-aoc2025-b4t7c1d5f8) | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🟢 Free | [Open](https://tryhackme.com/room/webattackforensics-aoc2025-b4t7c1d5f8) |
| [envizon](/en/tryhackme/rooms/envizon)                                                          | <span className="dbadge dbadge-easy">HARD</span>   | Challenge   | 🟢 Free | [Open](https://tryhackme.com/room/envizon)                               |

## Related skills

* [/en/skills/rce](/en/skills/rce)

***

← [Back to the full glossary](/en/glossary)

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"DefinedTerm","name":"OS Command Injection","termCode":"command-injection","inLanguage":"en","url":"https://rootea.es/en/skills/command-injection","inDefinedTermSet":{"@type":"DefinedTermSet","name":"Tactical pentesting glossary","url":"https://rootea.es/en/glossary"}}`}
</script>

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"ItemList","name":"HTB machines practicing OS Command Injection","numberOfItems":17,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://rootea.es/en/htb/machines/windows/insano/anubis","name":"Anubis"},{"@type":"ListItem","position":2,"url":"https://rootea.es/en/htb/machines/linux/medio/cronos","name":"Cronos"},{"@type":"ListItem","position":3,"url":"https://rootea.es/en/htb/machines/linux/facil/doctor","name":"Doctor"},{"@type":"ListItem","position":4,"url":"https://rootea.es/en/htb/machines/linux/medio/fluxcapacitor","name":"FluxCapacitor"},{"@type":"ListItem","position":5,"url":"https://rootea.es/en/htb/machines/linux/insano/fortune","name":"Fortune"},{"@type":"ListItem","position":6,"url":"https://rootea.es/en/htb/machines/linux/medio/haircut","name":"Haircut"},{"@type":"ListItem","position":7,"url":"https://rootea.es/en/htb/machines/windows/facil/netmon","name":"Netmon"},{"@type":"ListItem","position":8,"url":"https://rootea.es/en/htb/machines/linux/insano/nightmare","name":"Nightmare"},{"@type":"ListItem","position":9,"url":"https://rootea.es/en/htb/machines/linux/medio/node","name":"Node"},{"@type":"ListItem","position":10,"url":"https://rootea.es/en/htb/machines/linux/medio/noter","name":"Noter"},{"@type":"ListItem","position":11,"url":"https://rootea.es/en/htb/machines/linux/medio/obscurity","name":"Obscurity"},{"@type":"ListItem","position":12,"url":"https://rootea.es/en/htb/machines/linux/dificil/player","name":"Player"},{"@type":"ListItem","position":13,"url":"https://rootea.es/en/htb/machines/linux/facil/routerspace","name":"RouterSpace"},{"@type":"ListItem","position":14,"url":"https://rootea.es/en/htb/machines/linux/facil/scriptkiddie","name":"ScriptKiddie"},{"@type":"ListItem","position":15,"url":"https://rootea.es/en/htb/machines/linux/medio/union","name":"Union"},{"@type":"ListItem","position":16,"url":"https://rootea.es/en/htb/machines/linux/dificil/unobtainium","name":"Unobtainium"},{"@type":"ListItem","position":17,"url":"https://rootea.es/en/htb/machines/linux/medio/writer","name":"Writer"}]}`}
</script>

*Last updated: 2026-06-07*