
from aboutsecurity1,127
Comprehensive methodology for detecting, exploiting, and bypassing OS command injection, including blind extraction and output-filtering workarounds.
系统化覆盖命令注入(OS command injection)从定位到利用、输出绕过与盲注提取的实践方法论,适合渗透测试与CTF场景。包含分隔符与编码绕过策略、输出外泄技术、路径枚举、时间/盲注技巧以及 RCE 后的交互与降级方案。
在目标应用接受网络工具参数(如 ping/traceroute/DNS 查询)或任意将用户输入拼接进 shell 命令的场景下使用。本方法论适合:渗透测试定位注入点、构造高成功率 payload、在输出被过滤/无回显时进行盲注与带外外泄。
references/injection-bypass.md provide extensive bypass lists and examples (has_references=true).Likely usable by agents with shell execution or HTTP request tooling (Copilot/Codex/CLI agents) and security-focused toolchains that can run or template payloads.
This skill has not been reviewed by our automated audit pipeline yet.