cmdi-command-injection

A command injection playbook for security testing, applicable when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks. It opens with first-pass payload families organized by context, covering generic separators, quoted arguments, blind timing, command substitution, and out-of-band DNS, so a tester can quickly pick a starting payload and a backup.

The reference enumerates shell metacharacters and their behavior, including separators like semicolon and ampersand, pipes, conditional operators, command substitution via dollar-parentheses and backticks, redirects, and URL-encoded newlines. It then catalogs vulnerable code patterns across PHP, Python, Node.js, Perl, and Classic ASP, calling out sinks such as shell_exec, subprocess with the shell flag enabled, and child_process exec. For cases with no visible output, it details blind detection through time delays and out-of-band exfiltration over DNS, HTTP, or a web-accessible file.

Additional sections provide a payload library spanning information gathering and both Linux and Windows reverse shells, injection-context variations for quoted, single-quoted, backtick, and file-path contexts, and filter-bypass techniques including space alternatives such as IFS and brace expansion, slash alternatives, keyword assembly from variables, and newline injection. A list of common entry points, from network tools and file conversion to log viewing and archive processing, plus a blind-injection decision tree, helps locate and confirm findings. It is presented as a neutral, factual offensive-security testing resource.