One shell, two commands
A shell treats ; as "end of command, start another". If the server runs ping -c 1 -W 1 followed by your value, then sending 127.0.0.1;id makes it run ping ... 127.0.0.1 and id:
curl -s 'http://127.0.0.1:8080/api/ping?host=127.0.0.1;id'In the terminal
student@vulntech:~$ curl -s 'http://127.0.0.1:8080/api/ping?host=127.0.0.1;id' uid=997(www) gid=997(www) groups=997(www) ping: socktype: SOCK_RAW ping: socket: Operation not permitted ping: => missing cap_net_raw+p capability or setuid?
There it is: uid=...(www). You are now running arbitrary commands on the server as the www user. Other separators work too — | pipes into your command, and $(...) substitutes its output.
Common mistake: The output order can look backwards: the app returns everything your command printed to stdout first, then the ping errors from stderr. So your result often sits at the top of the response, not the bottom.