How the ping endpoint works

A convenience feature with a dark side

The /api/ping endpoint looks harmless: give it a host and it pings it for you.

curl -s 'http://127.0.0.1:8080/api/ping?host=127.0.0.1'

In the terminal

student@vulntech:~$ curl -s 'http://127.0.0.1:8080/api/ping?host=127.0.0.1'
ping: socktype: SOCK_RAW
ping: socket: Operation not permitted
ping: => missing cap_net_raw+p capability or setuid?

Behind the scenes the app builds a shell command out of your input — roughly ping -c 1 -W 1 <host> — and runs it. The host value you send is pasted straight into a command line that the server's shell executes. If you can smuggle shell syntax into that value, the shell will obey it.

Tip: On this machine ping itself can't open a raw socket, so you'll see a ping: socket: Operation not permitted error. Ignore it — the command after your injection is what matters.