Skip to content
BackEsc
Connect AISign inSign up free

Command Injection · passage 6 of 28

Inside A Command

Text · Command Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Connect AI

Open this passage on GitHub

* Command injection using backticks.

  original_cmd_by_server `cat /etc/passwd`

* Command injection using substitution

  original_cmd_by_server $(cat /etc/passwd)

Source: Command Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 28 is a mark on the map. Named now: 1 to 26, reading order first.

  1. Command Injection§ 1text · README.md
  2. Methodology§ 21 code block · README.md
  3. Basic Commands§ 31 code block · README.md
  4. Chaining Commands§ 41 code block · README.md
  5. Argument Injection§ 51 code block · README.md
  6. Inside A Command§ 6text · README.md
  7. Bypass Without Space§ 7text · README.md
  8. Bypass With A Line Return§ 81 code block · README.md
  9. Bypass With Backslash Newline§ 9text · README.md
  10. Bypass With Tilde Expansion§ 101 code block · README.md
  11. Bypass With Brace Expansion§ 111 code block · README.md
  12. Bypass Characters Filter§ 121 code block · README.md
  13. Bypass Characters Filter Via Hex Encoding§ 131 code block · README.md
  14. Bypass With Single Quote§ 141 code block · README.md
  15. Bypass With Double Quote§ 151 code block · README.md
  16. Bypass With Backticks§ 161 code block · README.md
  17. Bypass With Backslash and Slash§ 171 code block · README.md
  18. Bypass With $@§ 181 code block · README.md
  19. Bypass With $()§ 191 code block · README.md
  20. Bypass With Variable Expansion§ 201 code block · README.md
  21. Bypass With Wildcards§ 211 code block · README.md
  22. Bypass With Random Case§ 221 code block · README.md
  23. Time Based Data Exfiltration§ 23text · README.md
  24. Dns Based Data Exfiltration§ 24text · README.md
  25. Polyglot Command Injection§ 25text · README.md
  26. Backgrounding Long Running Commands§ 261 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Sign inSign up free

Updated