cmdi-command-injectionlisted

# SKILL: OS Command Injection — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Expert command injection techniques. Covers all shell metacharacters, blind injection, time-based detection, OOB exfiltration, polyglot payloads, and real-world code patterns. Base models miss subtle injection through unexpected input vectors. ## 0. RELATED ROUTING Before going deep, you can first load: - [injection-checking](../injection-checking/SKILL.md) — P1 router, use it first if you have not yet decided CMDi vs SQLi/SSTI/SSRF/XXE - [upload insecure files](../upload-insecure-files/SKILL.md) — when the shell sink is part of an upload/import/convert workflow - [reverse-shell-techniques](../reverse-shell-techniques/SKILL.md) — §5 keeps one-line payloads only; the full shell matrix lives here - [waf-bypass-techniques](../waf-bypass-techniques/SKILL.md) — §6/§9 cover CMDi-specific bypass; systematic WAF/IP-block evasion lives here - [code-audit](../code-audit/SKILL.md) — use to find process-exec sinks in source; this skill focuses on exploitation patterns - [pentest-tools](../pentest-tools/SKILL.md) — automated scanning with `commix` (blind/automated, `--os-shell`, `--tamper`); payload recipes there under `payloader/tools/web渗透.md` ### Quick jump | Need | Section | |---|---| | Sink syntax for a specific language | §2 | | Blind injection → confirm only | §3 first half | | Blind injection → extract data when OOB is blocked | §3 last block | | Argument injection (no metacharacters needed) |