---
name: validate-command-execution
description: Evidence bar, default command, blind output channels, PoC shape and report steps for server-side command execution. Use when validating a finding that claims RCE, command injection, or code execution through template injection, `eval` or deserialisation.
---

# Validate command execution

## Establish execution

- Require output that only the target could produce, such as its hostname or kernel version, not text your payload put there. A callback can come from a link-preview bot, proxy or URL scanner rather than the target, so it counts only when it carries the command's output.
- Describe execution identity, environment and persistence only as far as the evidence shows. Do not infer persistence from a repeated hostname, or host compromise from execution inside a container.
- When the primitive is code execution in a language runtime, such as template injection, `eval` or deserialization, run the command through the runtime's process API (`/bin/sh -c`). If the runtime cannot spawn processes, show the equivalent values through its own APIs.

## Command

- The default command is `whoami; hostname; uname -a`. On Windows, use `whoami & hostname & ver`. For an unstable or very slow exploit, use `whoami` alone.
- Run nothing beyond the default command and what the blind channels below need. Do not read environment variables, credentials, keys or other files: they prove nothing more, and their values would land in the stored traffic and the report. No reverse shells, persistence, file changes, internal scanning or other users' data.

## Retrieve the output

- First return the output through the vulnerable response or another target-visible result. Do not use a callback while in-band output may be available.
- When the sink is blind, use the first channel that works, with a fresh token per run:
  1. **HTTP or HTTPS:** send the output in a request to the callback the validator prompt allows for final PoCs, encoded so it survives transport, such as base64 in the body or a parameter.
  2. **DNS:** send the output hex- or base32-encoded in labels of up to 63 characters, numbered so the PoC can reassemble them in order.
  3. **Readable file:** when the application serves a well-known writable location, such as a vendor product's static or upload directory, write the output to `<uuid>-<username>.txt` there or to another extension it serves, fetch it, then delete it.
  4. **Timing:** when none of these works, show execution with differential delays (`sleep 5` against `sleep 0`, repeated). State that output could not be retrieved, because that is weaker evidence.
- The PoC prints the decoded output, not the callback record.

## PoC

- Automate every step. The triager supplies nothing but an optional `--cmd`; also accept `--command` as an alias. Without a flag, the PoC runs the default command.
- Hardcode the researcher-owned test account's credentials as defaults, with optional flags for another account.
- Only when signing up or logging in genuinely cannot be automated, accept `--session <file>` holding the `Cookie` or `Authorization` header copied from a logged-in browser or Burp. Check the session first and say clearly when it is missing or expired.
- Print only the command's output on stdout. Send progress to stderr. When a step fails, print which step and why to stderr and exit non-zero.

## Report

- In a bounty report, the reproduction steps are:

  ````
  1. Download the attached `<name>.py`.
  2. Run it. It executes `whoami; hostname; uname -a` on the target and prints the output; pass `--cmd "<command>"` to run another command:

     ```bash
     uv run <name>.py
     ```

     ```
     <verbatim stdout>
     ```
  ````

  Add the `--session` login step first only when the PoC needs it, and include the equivalent `--proxy` command as the `write-finding-report` skill requires.
- The manual reproduction that follows gives the minimal raw request or requests with the payload, using `whoami` as the command, and shows where its output appears: the response, the callback, the fetched file or the delay.