NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
NetDiag is an internal 'is this host up?' tool that shells out to ping with the hostname you provide — and it trusts internal users a little too much. Make it run your command and read the flag file at /tmp/.netdiag/flag.txt.
#command-injection#rce#web
DifficultyMedium
Live Environment
Ready
Spin up your own private, isolated instance of this challenge.
Auto shutdown after 60 minutes
Isolated sandbox
Captured flags are saved independently of the environment
One-click restart
Submit Flag
Hints
Unlocking any hint — including free ones — forfeits the +25% no-hint solve bonus.
It is a flaw where user input is passed to a system shell, letting an attacker append their own commands and run them with the application's privileges.
Which characters are used in command injection?
Shell metacharacters such as ;, &&, | and backticks chain or substitute commands. Their effect depends on the shell and how the command is built.
How do you prevent command injection?
Avoid calling shells, use safe APIs with argument lists, and validate input against strict allowlists. NetDiag is free on Codelivly for practice.