Command and Code Injection · payload topic
Command Injection
28 passages · 20 code blocks
Every mark is a titled passage of this topic's pages, in reading order; the brighter ones carry code. For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.
Open Command Injection on GitHubCommand injection is a security vulnerability that allows an attacker to execute arbitrary commands inside a vulnerable application.
Source: PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.
Every one of the 28 is a mark on the map. Named now: 1 to 26, reading order first.
- Command Injection
- Methodology
- Basic Commands
- Chaining Commands
- Argument Injection
- Inside A Command
- Bypass Without Space
- Bypass With A Line Return
- Bypass With Backslash Newline
- Bypass With Tilde Expansion
- Bypass With Brace Expansion
- Bypass Characters Filter
- Bypass Characters Filter Via Hex Encoding
- Bypass With Single Quote
- Bypass With Double Quote
- Bypass With Backticks
- Bypass With Backslash and Slash
- Bypass With $@
- Bypass With $()
- Bypass With Variable Expansion
- Bypass With Wildcards
- Bypass With Random Case
- Time Based Data Exfiltration
- Dns Based Data Exfiltration
- Polyglot Command Injection
- Backgrounding Long Running Commands
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.