This is a write-up on how I find and exploit an OS command injection vulnerability on a web server.