Command substitution, `cmd` and $(cmd), runs a nested command and splices its output into the surrounding command line. Because it is evaluated even when the injection point sits in the middle of an argument, it is both a primary execution primitive and one of the most reliable confirmation oracles for command injection.
Pages#
- Backticks and $(...): Using $(...) and backtick command substitution to run a nested command and splice its output into the current command line, working even when the injection p...
Tools#
- commix: automated command-injection exploitation.
- Burp Suite: Repeater for crafting substitution payloads.