cybersecurity · beginner · ~15 min · safe pentest lab

Does the code call system()?

Find the shell-invoking call.

Challenge

Flag the shell-invoking system( call — a red flag for command injection whenever its argument is attacker-influenced.

Task

Implement int uses_system(const char *code) that returns 1 if code contains the substring "system(", else 0.

Input

  • code: a NUL-terminated string of C source text the grader passes.

Output

Returns int: 1 if "system(" appears anywhere in code, else 0.

Example

uses_system("system(cmd);")        ->   1
uses_system("execv(path, argv);")  ->   0

Edge cases

  • Code that uses the exec family instead of the shell returns 0.

Rules

  • Detection only — operate on the string the grader passes.

Input format

A NUL-terminated string code of C source text.

Output format

An int: 1 if code contains "system(", else 0.

Constraints

Match the system( substring.

Starter code

#include <string.h>

int uses_system(const char *code) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.