Web applications frequently process user-supplied input to perform operations such as file handling, system information retrieval, data processing, and application administration. In some applications, server-side code passes user-controlled input to operating-system commands to perform specific operations.
OS Command Injection is a vulnerability in which insufficiently controlled input influences operating-system command execution. If an application constructs or executes commands using untrusted input without adequate protection, an attacker may manipulate the input to cause unintended command execution.
Traditional source-code reviews and security scanners can identify some command-injection weaknesses by examining potentially dangerous functions, input validation, and the flow of untrusted data. However, identifying the relationship between a user-controlled input and a potentially dangerous execution point can require examining multiple connected parts of the program.
Graph-based source-code analysis provides another approach by representing program structures and relationships as graphs. A Graph Neural Network (GNN) can learn patterns from these graph representations and classify code samples according to the vulnerability categories represented in its training data.
In this use case, OWASP WebGoat is deployed within an isolated cybersecurity laboratory using Ubuntu Linux and Kali Linux virtual machines. WebGoat contains a dedicated command-injection lesson, providing a controlled environment for investigating this vulnerability.
A publicly available, labelled source-code vulnerability dataset is used as the starting point for the machine-learning stage. The dataset is inspected to verify its programming language, vulnerability labels, source-code availability, and suitability for graph-based classification. Java source-code examples associated with OS Command Injection are required to support the intended relationship between the training data and the Java-based WebGoat application.
Joern is used to analyse supported source code and generate program-representation graphs. Python and PyTorch Geometric are used to prepare graph inputs, train the GNN, and generate predictions for previously unseen code samples.
The trained model is then evaluated against source-code samples associated with the WebGoat command-injection scenario. A controlled command-injection attack is performed against the local WebGoat application to validate the selected vulnerable scenario. The attack result is compared with the source-code analysis findings.
The project investigates whether graph-based source-code representations can help identify command-injection-related weaknesses and whether the resulting findings correspond to a controlled attack scenario.
Application: OWASP WebGoat
OWASP WebGoat is an intentionally vulnerable web application designed to teach web application security concepts through practical lessons. Its official lesson repository includes a dedicated command-injection lesson.
In this use case, WebGoat is deployed locally within the authorized laboratory. Ubuntu Linux hosts the application and machine-learning environment, while Kali Linux supports controlled security testing.
Web applications may execute operating-system commands as part of their functionality. If untrusted input reaches a command-execution point without adequate validation and protection, the application may become vulnerable to OS Command Injection.
A source-code reviewer may need to examine several connected program elements to understand how input travels from its origin to a potentially dangerous execution point.
For example, user-controlled input may pass through request handlers, helper functions, transformations, and validation routines before reaching a command-execution function. Analysing these relationships requires understanding more than the presence of a single function call.
Traditional pattern-based scanning can identify certain suspicious constructs, but the existence of a potentially dangerous function does not automatically establish that a vulnerability is exploitable. The surrounding data flow, input controls, and execution context must also be examined.
The proposed solution introduces a GNN-based source-code classification mechanism that examines graph representations of program structures and data-flow relationships. Controlled attack simulation is used to validate the selected vulnerability scenario independently of the model prediction.
Specific Attack: Controlled OS Command Injection Attack
The controlled attack evaluates whether input supplied to the local OWASP WebGoat command-injection lesson can influence an operating-system command in an unintended manner.
The attack is performed only against the deliberately vulnerable WebGoat instance inside the isolated VirtualBox laboratory. The test uses the application's designated lesson and a non-sensitive test environment.
The objective is to generate observable evidence of the command-injection scenario and compare that evidence with the corresponding source-code analysis findings.
The controlled attack does not target external systems or production applications. It does not involve destructive commands, persistence, credential theft, or unauthorised access.
Graph Neural Network-Based Source-Code Vulnerability Detection
The primary security concept is graph-based source-code vulnerability analysis combined with controlled OS Command Injection attack validation.
The project investigates whether relationships between program elements provide useful information for classifying code samples associated with command-injection vulnerabilities.
Source-Code Graph Representation : The selected Java source-code samples are analysed using Joern, where supported, to generate graph representations of program structure and relationships. The graph may contain nodes representing program elements and edges representing relationships such as control flow, data flow, or other supported program connections. The resulting graph is prepared as input for the GNN.
GNN-Based Vulnerability Classification : A Graph Neural Network implemented with PyTorch Geometric learns representations from the graph structures and their node features. The model classifies code samples according to the verified vulnerability labels available in the training dataset. The model's ability to identify OS Command Injection must be established through appropriate evaluation. It must not be assumed that a model trained on generic vulnerable code automatically detects command injection specifically.
Controlled Attack Validation : The trained model's findings are compared with the source code associated with the WebGoat command-injection lesson. A controlled attack is performed against the local application to observe whether the selected scenario demonstrates the intended vulnerability. The application response, relevant source-code path, and GNN prediction are examined together. A successful attack can support validation of the selected scenario, but it does not independently establish the model's overall detection accuracy.
The security concept defines the overall vulnerability-detection strategy.
The following defensive mechanisms support the implementation.
The source code associated with command processing is examined to identify input sources, transformations, validation routines, and potentially dangerous execution points.
Joern is used to produce supported graph representations of the selected source code.
The GNN classifies graph representations according to the categories supported by the verified training data.
The same graph-generation and feature-preparation process is applied to compatible training, evaluation, and target code.
Nmap identifies the expected WebGoat service within the authorised laboratory.
A controlled command-injection scenario is performed against the local WebGoat lesson.
OWASP ZAP and Wireshark support inspection of application requests, responses, and network-level communication during controlled testing.
The GNN prediction is compared with source-code findings and the observed attack result.
Input validation, safe process invocation, avoidance of unsafe shell construction, and appropriate execution restrictions are recognised as relevant prevention measures.
OWASP WebGoat provides the deliberately vulnerable web application used for controlled command-injection testing. Its lesson repository includes a command-injection lesson.
Kali Linux is used as the controlled security-testing environment.
Ubuntu hosts the application and machine-learning components.
VirtualBox provides the isolated laboratory infrastructure.
Nmap identifies services exposed by the authorised laboratory target.
Wireshark captures and examines network packets exchanged during controlled testing.
OWASP ZAP supports inspection of HTTP requests and responses during authorised web application testing.
Python provides the main environment for dataset processing, graph preparation, model training, classification, and evaluation.
Joern is used to analyse supported source code and generate code property graphs or related program representations.
PyTorch Geometric provides graph-learning components that can be used to implement the GNN classifier.
PyTorch provides the underlying tensor and neural-network operations used by PyTorch Geometric.
Pandas is used to inspect dataset metadata, labels, source-code references, and model results.
NumPy supports numerical feature preparation and experiment-data processing.
Semgrep can provide supplementary source-code findings for supported rules and languages.
Scikit-learn provides data-splitting utilities and classification metrics.
SQLite can store experiment metadata, graph references, model predictions, and attack-validation results.
OWASP WebGoat is deployed within an isolated Ubuntu and Kali Linux laboratory, providing a controlled environment for command-injection security testing.
Nmap is used to identify and verify the expected WebGoat service exposure within the authorised laboratory network.
A publicly available source-code vulnerability dataset is inspected to determine whether it provides verified labels and suitable Java source-code samples for the intended GNN classification task.
The selected source-code samples are preprocessed and converted into graph representations using Joern and the associated graph-processing workflow.
A Graph Neural Network is implemented using PyTorch Geometric and trained using the verified labels available in the selected dataset
The trained GNN is evaluated using held-out graph samples, and actual classification metrics are recorded to assess its performance.
The source code associated with the WebGoat command-injection lesson is analysed to identify relevant input-processing and command-execution relationships.
A controlled OS Command Injection attack is performed against the local WebGoat application, and its HTTP and application evidence is captured using the selected security-testing tools.
The GNN prediction, source-code analysis findings, and controlled attack result are compared to determine whether the identified code sample corresponds to the intended vulnerability scenario.
The complete workflow demonstrates a practical investigation of GNN-based source-code vulnerability classification for OS Command Injection, combining public-dataset preparation, graph generation, model training, controlled attack simulation, cybersecurity tool usage, and evidence-based validation.
Research Breakthrough Possible @S-Logix