Command Injection · passage 20 of 28

Bypass With Variable Expansion

1 code block · Command Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

/???/??t /???/p??s??

test=/ehhh/hmtc/pahhh/hmsswd
cat ${test//hhh\/hm/}
cat ${test//hh??hm/}

Every one of the 28 is a mark on the map. Named now: 1 to 26, reading order first.

Command Injection§ 1text · README.md
Methodology§ 21 code block · README.md
Basic Commands§ 31 code block · README.md
Chaining Commands§ 41 code block · README.md
Argument Injection§ 51 code block · README.md
Inside A Command§ 6text · README.md
Bypass Without Space§ 7text · README.md
Bypass With A Line Return§ 81 code block · README.md
Bypass With Backslash Newline§ 9text · README.md
Bypass With Tilde Expansion§ 101 code block · README.md
Bypass With Brace Expansion§ 111 code block · README.md
Bypass Characters Filter§ 121 code block · README.md
Bypass Characters Filter Via Hex Encoding§ 131 code block · README.md
Bypass With Single Quote§ 141 code block · README.md
Bypass With Double Quote§ 151 code block · README.md
Bypass With Backticks§ 161 code block · README.md
Bypass With Backslash and Slash§ 171 code block · README.md
Bypass With $@§ 181 code block · README.md
Bypass With $()§ 191 code block · README.md
Bypass With Variable Expansion§ 201 code block · README.md
Bypass With Wildcards§ 211 code block · README.md
Bypass With Random Case§ 221 code block · README.md
Time Based Data Exfiltration§ 23text · README.md
Dns Based Data Exfiltration§ 24text · README.md
Polyglot Command Injection§ 25text · README.md
Backgrounding Long Running Commands§ 261 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.