Commands can also be run in sequence with newlines
original_cmd_by_server
lsSource: Command Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.
Command Injection · passage 8 of 28
Bypass With A Line Return
1 code block · Command Injection/README.md
For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.
Open this passage on GitHubEvery one of the 28 is a mark on the map. Named now: 1 to 26, reading order first.
- Command Injection
- Methodology
- Basic Commands
- Chaining Commands
- Argument Injection
- Inside A Command
- Bypass Without Space
- Bypass With A Line Return
- Bypass With Backslash Newline
- Bypass With Tilde Expansion
- Bypass With Brace Expansion
- Bypass Characters Filter
- Bypass Characters Filter Via Hex Encoding
- Bypass With Single Quote
- Bypass With Double Quote
- Bypass With Backticks
- Bypass With Backslash and Slash
- Bypass With $@
- Bypass With $()
- Bypass With Variable Expansion
- Bypass With Wildcards
- Bypass With Random Case
- Time Based Data Exfiltration
- Dns Based Data Exfiltration
- Polyglot Command Injection
- Backgrounding Long Running Commands
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.