# NetDiag — OS Command Injection (lab)

> NetDiag pings a host you type — by pasting it into a shell command. Add your own command with a shell separator and it runs on the server. Read the flag from the environment.

Canonical: https://codelivly.com/labs/command-injection

| | |
|---|---|
| Type | Web |
| Difficulty | Intermediate |
| Points | 300 |
| Session length | 30 min |
| Completions | 18 |

NetDiag pings a host you type — by pasting it into a shell command. Add your own command with a shell separator and it runs on the server. Read the flag from the environment.

## Objective

Learn OS command injection: when a web app builds a shell command out of your input, shell metacharacters let you run commands of your own on the server.

## Tasks

1. Open the tool
2. Realise it uses a shell
3. Chain a second command
4. Print the flag
5. Capture the flag

## Related

- [All labs](https://codelivly.com/practice?type=lab)